| Message ID | 20220208225350.1331628-7-keescook@chromium.org (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 92df138a8d663cefebc3124041253677a53c92cf |
| Headers | show |
| Series | fortify: Add Clang support | expand |
On Tue, Feb 8, 2022 at 2:53 PM Kees Cook <keescook@chromium.org> wrote: > > In preparation for using Clang's __pass_object_size, add __diagnose_as() > attributes to mark the functions as being the same as the indicated > builtins. When __daignose_as() is available, Clang will have a more > complete ability to apply its own diagnostic analysis to callers of these > functions, as if they were the builtins themselves. Without __diagnose_as, > Clang's compile time diagnostic messages won't be as precise as they > could be, but at least users of older toolchains will still benefit from > having fortified routines. Yes, much easier to review split up. Thanks for taking the time to do so! Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> > > Signed-off-by: Kees Cook <keescook@chromium.org> > --- > include/linux/fortify-string.h | 21 ++++++++++++++------- > 1 file changed, 14 insertions(+), 7 deletions(-) > > diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h > index f874ada4b9af..db1ad1c1c79a 100644 > --- a/include/linux/fortify-string.h > +++ b/include/linux/fortify-string.h > @@ -50,7 +50,8 @@ extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) > #define __underlying_strncpy __builtin_strncpy > #endif > > -__FORTIFY_INLINE char *strncpy(char * const p, const char *q, __kernel_size_t size) > +__FORTIFY_INLINE __diagnose_as(__builtin_strncpy, 1, 2, 3) > +char *strncpy(char * const p, const char *q, __kernel_size_t size) > { > size_t p_size = __builtin_object_size(p, 1); > > @@ -61,7 +62,8 @@ __FORTIFY_INLINE char *strncpy(char * const p, const char *q, __kernel_size_t si > return __underlying_strncpy(p, q, size); > } > > -__FORTIFY_INLINE char *strcat(char * const p, const char *q) > +__FORTIFY_INLINE __diagnose_as(__builtin_strcat, 1, 2) > +char *strcat(char * const p, const char *q) > { > size_t p_size = __builtin_object_size(p, 1); > > @@ -94,7 +96,8 @@ __FORTIFY_INLINE __kernel_size_t strnlen(const char * const p, __kernel_size_t m > } > > /* defined after fortified strnlen to reuse it. */ > -__FORTIFY_INLINE __kernel_size_t strlen(const char * const p) > +__FORTIFY_INLINE __diagnose_as(__builtin_strlen, 1) > +__kernel_size_t strlen(const char * const p) > { > __kernel_size_t ret; > size_t p_size = __builtin_object_size(p, 1); > @@ -183,7 +186,8 @@ __FORTIFY_INLINE ssize_t strscpy(char * const p, const char * const q, size_t si > } > > /* defined after fortified strlen and strnlen to reuse them */ > -__FORTIFY_INLINE char *strncat(char * const p, const char * const q, __kernel_size_t count) > +__FORTIFY_INLINE __diagnose_as(__builtin_strncat, 1, 2, 3) > +char *strncat(char * const p, const char * const q, __kernel_size_t count) > { > size_t p_len, copy_len; > size_t p_size = __builtin_object_size(p, 1); > @@ -365,7 +369,8 @@ __FORTIFY_INLINE void *memscan(void * const p, int c, __kernel_size_t size) > return __real_memscan(p, c, size); > } > > -__FORTIFY_INLINE int memcmp(const void * const p, const void * const q, __kernel_size_t size) > +__FORTIFY_INLINE __diagnose_as(__builtin_memcmp, 1, 2, 3) > +int memcmp(const void * const p, const void * const q, __kernel_size_t size) > { > size_t p_size = __builtin_object_size(p, 0); > size_t q_size = __builtin_object_size(q, 0); > @@ -381,7 +386,8 @@ __FORTIFY_INLINE int memcmp(const void * const p, const void * const q, __kernel > return __underlying_memcmp(p, q, size); > } > > -__FORTIFY_INLINE void *memchr(const void * const p, int c, __kernel_size_t size) > +__FORTIFY_INLINE __diagnose_as(__builtin_memchr, 1, 2, 3) > +void *memchr(const void * const p, int c, __kernel_size_t size) > { > size_t p_size = __builtin_object_size(p, 0); > > @@ -417,7 +423,8 @@ __FORTIFY_INLINE void *kmemdup(const void * const p, size_t size, gfp_t gfp) > } > > /* Defined after fortified strlen to reuse it. */ > -__FORTIFY_INLINE char *strcpy(char * const p, const char * const q) > +__FORTIFY_INLINE __diagnose_as(__builtin_strcpy, 1, 2) > +char *strcpy(char * const p, const char * const q) > { > size_t p_size = __builtin_object_size(p, 1); > size_t q_size = __builtin_object_size(q, 1); > -- > 2.30.2 >
diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h index f874ada4b9af..db1ad1c1c79a 100644 --- a/include/linux/fortify-string.h +++ b/include/linux/fortify-string.h @@ -50,7 +50,8 @@ extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) #define __underlying_strncpy __builtin_strncpy #endif -__FORTIFY_INLINE char *strncpy(char * const p, const char *q, __kernel_size_t size) +__FORTIFY_INLINE __diagnose_as(__builtin_strncpy, 1, 2, 3) +char *strncpy(char * const p, const char *q, __kernel_size_t size) { size_t p_size = __builtin_object_size(p, 1); @@ -61,7 +62,8 @@ __FORTIFY_INLINE char *strncpy(char * const p, const char *q, __kernel_size_t si return __underlying_strncpy(p, q, size); } -__FORTIFY_INLINE char *strcat(char * const p, const char *q) +__FORTIFY_INLINE __diagnose_as(__builtin_strcat, 1, 2) +char *strcat(char * const p, const char *q) { size_t p_size = __builtin_object_size(p, 1); @@ -94,7 +96,8 @@ __FORTIFY_INLINE __kernel_size_t strnlen(const char * const p, __kernel_size_t m } /* defined after fortified strnlen to reuse it. */ -__FORTIFY_INLINE __kernel_size_t strlen(const char * const p) +__FORTIFY_INLINE __diagnose_as(__builtin_strlen, 1) +__kernel_size_t strlen(const char * const p) { __kernel_size_t ret; size_t p_size = __builtin_object_size(p, 1); @@ -183,7 +186,8 @@ __FORTIFY_INLINE ssize_t strscpy(char * const p, const char * const q, size_t si } /* defined after fortified strlen and strnlen to reuse them */ -__FORTIFY_INLINE char *strncat(char * const p, const char * const q, __kernel_size_t count) +__FORTIFY_INLINE __diagnose_as(__builtin_strncat, 1, 2, 3) +char *strncat(char * const p, const char * const q, __kernel_size_t count) { size_t p_len, copy_len; size_t p_size = __builtin_object_size(p, 1); @@ -365,7 +369,8 @@ __FORTIFY_INLINE void *memscan(void * const p, int c, __kernel_size_t size) return __real_memscan(p, c, size); } -__FORTIFY_INLINE int memcmp(const void * const p, const void * const q, __kernel_size_t size) +__FORTIFY_INLINE __diagnose_as(__builtin_memcmp, 1, 2, 3) +int memcmp(const void * const p, const void * const q, __kernel_size_t size) { size_t p_size = __builtin_object_size(p, 0); size_t q_size = __builtin_object_size(q, 0); @@ -381,7 +386,8 @@ __FORTIFY_INLINE int memcmp(const void * const p, const void * const q, __kernel return __underlying_memcmp(p, q, size); } -__FORTIFY_INLINE void *memchr(const void * const p, int c, __kernel_size_t size) +__FORTIFY_INLINE __diagnose_as(__builtin_memchr, 1, 2, 3) +void *memchr(const void * const p, int c, __kernel_size_t size) { size_t p_size = __builtin_object_size(p, 0); @@ -417,7 +423,8 @@ __FORTIFY_INLINE void *kmemdup(const void * const p, size_t size, gfp_t gfp) } /* Defined after fortified strlen to reuse it. */ -__FORTIFY_INLINE char *strcpy(char * const p, const char * const q) +__FORTIFY_INLINE __diagnose_as(__builtin_strcpy, 1, 2) +char *strcpy(char * const p, const char * const q) { size_t p_size = __builtin_object_size(p, 1); size_t q_size = __builtin_object_size(q, 1);
In preparation for using Clang's __pass_object_size, add __diagnose_as() attributes to mark the functions as being the same as the indicated builtins. When __daignose_as() is available, Clang will have a more complete ability to apply its own diagnostic analysis to callers of these functions, as if they were the builtins themselves. Without __diagnose_as, Clang's compile time diagnostic messages won't be as precise as they could be, but at least users of older toolchains will still benefit from having fortified routines. Signed-off-by: Kees Cook <keescook@chromium.org> --- include/linux/fortify-string.h | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)