| Message ID | 20240123002814.1396804-3-keescook@chromium.org (mailing list archive) |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | overflow: Refactor open-coded arithmetic wrap-around | expand |
On 23/01/2024 01.26, Kees Cook wrote: > Provide a helper that will perform wrapping addition without tripping > the arithmetic wrap-around sanitizers. > > Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> > Cc: linux-hardening@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> > --- > include/linux/overflow.h | 16 ++++++++++++++++ > 1 file changed, 16 insertions(+) > > diff --git a/include/linux/overflow.h b/include/linux/overflow.h > index ac088f73e0fd..30779905a77a 100644 > --- a/include/linux/overflow.h > +++ b/include/linux/overflow.h > @@ -124,6 +124,22 @@ static inline bool __must_check __must_check_overflow(bool overflow) > check_add_overflow(a, b, &__result);\ > })) > > +/** > + * add_wrap() - Intentionally perform a wrapping addition > + * @a: first addend > + * @b: second addend > + * > + * Return the potentially wrapped-around addition without > + * tripping any overflow sanitizers that may be enabled. > + */ > +#define add_wrap(a, b) \ > + ({ \ > + typeof(a) __sum; \ > + if (check_add_overflow(a, b, &__sum)) \ > + /* do nothing */; \ > + __sum; \ > + }) > + I don't know where this is supposed to be used, but at first glance this seems to introduce a footgun. This is not symmetric in a and b, so both the type and value of the result may differ between add_wrap(a, b) and add_wrap(b, a). That seems dangerous. Rasmus
On Mon, Jan 22, 2024 at 04:26:38PM -0800, Kees Cook wrote: > Provide a helper that will perform wrapping addition without tripping > the arithmetic wrap-around sanitizers. > > Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> > Cc: linux-hardening@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> > --- > include/linux/overflow.h | 16 ++++++++++++++++ > 1 file changed, 16 insertions(+) > > diff --git a/include/linux/overflow.h b/include/linux/overflow.h > index ac088f73e0fd..30779905a77a 100644 > --- a/include/linux/overflow.h > +++ b/include/linux/overflow.h > @@ -124,6 +124,22 @@ static inline bool __must_check __must_check_overflow(bool overflow) > check_add_overflow(a, b, &__result);\ > })) > > +/** > + * add_wrap() - Intentionally perform a wrapping addition > + * @a: first addend > + * @b: second addend > + * > + * Return the potentially wrapped-around addition without > + * tripping any overflow sanitizers that may be enabled. > + */ > +#define add_wrap(a, b) \ > + ({ \ > + typeof(a) __sum; \ > + if (check_add_overflow(a, b, &__sum)) \ > + /* do nothing */; \ > + __sum; \ > + }) It's really difficult to see the semicolon for the empty statement here; could we make that part: if ((check_add_overflow(a, b, &__sum)) { \ /* do nothing */ \ } \ ... to be a little clearer (and less at risk of breakage in a refactoring)? I realise coding style says not to use braces for a single statement, but IMO it's far clearer in this instance with the braces. Mark. > + > /** > * check_sub_overflow() - Calculate subtraction with overflow checking > * @a: minuend; value to subtract from > -- > 2.34.1 > >
On Tue, Jan 23, 2024 at 09:14:20AM +0100, Rasmus Villemoes wrote: > On 23/01/2024 01.26, Kees Cook wrote: > > Provide a helper that will perform wrapping addition without tripping > > the arithmetic wrap-around sanitizers. > > > > Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> > > Cc: linux-hardening@vger.kernel.org > > Signed-off-by: Kees Cook <keescook@chromium.org> > > --- > > include/linux/overflow.h | 16 ++++++++++++++++ > > 1 file changed, 16 insertions(+) > > > > diff --git a/include/linux/overflow.h b/include/linux/overflow.h > > index ac088f73e0fd..30779905a77a 100644 > > --- a/include/linux/overflow.h > > +++ b/include/linux/overflow.h > > @@ -124,6 +124,22 @@ static inline bool __must_check __must_check_overflow(bool overflow) > > check_add_overflow(a, b, &__result);\ > > })) > > > > +/** > > + * add_wrap() - Intentionally perform a wrapping addition > > + * @a: first addend > > + * @b: second addend > > + * > > + * Return the potentially wrapped-around addition without > > + * tripping any overflow sanitizers that may be enabled. > > + */ > > +#define add_wrap(a, b) \ > > + ({ \ > > + typeof(a) __sum; \ > > + if (check_add_overflow(a, b, &__sum)) \ > > + /* do nothing */; \ > > + __sum; \ > > + }) > > + > > I don't know where this is supposed to be used, but at first glance this > seems to introduce a footgun. This is not symmetric in a and b, so both > the type and value of the result may differ between add_wrap(a, b) and > add_wrap(b, a). That seems dangerous. I see three options here (and for add_would_overflow()): 1- document that it is typed to the first argument (but this seems weak) 2- require a and b have the same type, and use typeof(a) (but is possibly inflexible, like the problems we've had with min()/max()) 3- explicitly require a result type (this seems overly verbose, and might have problems like we've had with min_t()/max_t()) In the one place this series uses add_wrap(), I have these arguments: int segs u32 delta and the result type is expected to be int: return atomic_add_return(add_wrap(segs, delta), p_id) - segs; So as written (option 1) it's (accidentally?) correct. It would be rejected with option 2, which seems a strong signal that it's not a good option. So, your idea about explicit typing is probably best, since I can't examine the lvalue type within the macro. return atomic_add_return(add_wrap(int, segs, delta), p_id) - segs; I'll give this a try and check for binary differences. -Kees
On Tue, Jan 23, 2024 at 09:22:52AM +0000, Mark Rutland wrote: > On Mon, Jan 22, 2024 at 04:26:38PM -0800, Kees Cook wrote: > > Provide a helper that will perform wrapping addition without tripping > > the arithmetic wrap-around sanitizers. > > > > Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> > > Cc: linux-hardening@vger.kernel.org > > Signed-off-by: Kees Cook <keescook@chromium.org> > > --- > > include/linux/overflow.h | 16 ++++++++++++++++ > > 1 file changed, 16 insertions(+) > > > > diff --git a/include/linux/overflow.h b/include/linux/overflow.h > > index ac088f73e0fd..30779905a77a 100644 > > --- a/include/linux/overflow.h > > +++ b/include/linux/overflow.h > > @@ -124,6 +124,22 @@ static inline bool __must_check __must_check_overflow(bool overflow) > > check_add_overflow(a, b, &__result);\ > > })) > > > > +/** > > + * add_wrap() - Intentionally perform a wrapping addition > > + * @a: first addend > > + * @b: second addend > > + * > > + * Return the potentially wrapped-around addition without > > + * tripping any overflow sanitizers that may be enabled. > > + */ > > +#define add_wrap(a, b) \ > > + ({ \ > > + typeof(a) __sum; \ > > + if (check_add_overflow(a, b, &__sum)) \ > > + /* do nothing */; \ > > + __sum; \ > > + }) > > It's really difficult to see the semicolon for the empty statement here; could > we make that part: > > if ((check_add_overflow(a, b, &__sum)) { \ > /* do nothing */ \ > } \ > > ... to be a little clearer (and less at risk of breakage in a refactoring)? Yeah, agreed -- that stands out more clearly. -Kees
diff --git a/include/linux/overflow.h b/include/linux/overflow.h index ac088f73e0fd..30779905a77a 100644 --- a/include/linux/overflow.h +++ b/include/linux/overflow.h @@ -124,6 +124,22 @@ static inline bool __must_check __must_check_overflow(bool overflow) check_add_overflow(a, b, &__result);\ })) +/** + * add_wrap() - Intentionally perform a wrapping addition + * @a: first addend + * @b: second addend + * + * Return the potentially wrapped-around addition without + * tripping any overflow sanitizers that may be enabled. + */ +#define add_wrap(a, b) \ + ({ \ + typeof(a) __sum; \ + if (check_add_overflow(a, b, &__sum)) \ + /* do nothing */; \ + __sum; \ + }) + /** * check_sub_overflow() - Calculate subtraction with overflow checking * @a: minuend; value to subtract from
Provide a helper that will perform wrapping addition without tripping the arithmetic wrap-around sanitizers. Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> Cc: linux-hardening@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> --- include/linux/overflow.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)