Gain coverage for pointer wrap-around checking. Adds support for
-fsanitize=pointer-overflow, and introduces the __pointer_wrap function
attribute to match the signed and unsigned attributes. Also like the
others, it is currently disabled under CONFIG_COMPILE_TEST.

Cc: Andrew Morton <a...@linux-foundation.org>
Cc: Masahiro Yamada <masahi...@kernel.org>
Cc: Nathan Chancellor <nat...@kernel.org>
Cc: Nicolas Schier <nico...@fjasle.eu>
Cc: linux-kbu...@vger.kernel.org
Signed-off-by: Kees Cook <keesc...@chromium.org>
---
 include/linux/compiler_types.h |  7 ++++++-
 lib/Kconfig.ubsan              |  8 ++++++++
 lib/test_ubsan.c               | 33 +++++++++++++++++++++++++++++++++
 lib/ubsan.c                    | 21 +++++++++++++++++++++
 lib/ubsan.h                    |  1 +
 scripts/Makefile.ubsan         |  1 +
 6 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index e585614f3152..e65ce55046fd 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -293,12 +293,17 @@ struct ftrace_likely_data {
 #else
 # define __unsigned_wrap
 #endif
+#ifdef CONFIG_UBSAN_POINTER_WRAP
+# define __pointer_wrap __attribute__((no_sanitize("pointer-overflow")))
+#else
+# define __pointer_wrap
+#endif
 
 /* Section for code which can't be instrumented at all */
 #define __noinstr_section(section)                                     \
        noinline notrace __attribute((__section__(section)))            \
        __no_kcsan __no_sanitize_address __no_profile __no_sanitize_coverage \
-       __no_sanitize_memory __signed_wrap __unsigned_wrap
+       __no_sanitize_memory __signed_wrap __unsigned_wrap __pointer_wrap
 
 #define noinstr __noinstr_section(".noinstr.text")
 
diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
index a7003e5bd2a1..04222a6d7fd9 100644
--- a/lib/Kconfig.ubsan
+++ b/lib/Kconfig.ubsan
@@ -135,6 +135,14 @@ config UBSAN_UNSIGNED_WRAP
          for wrap-around of any arithmetic operations with unsigned integers. 
This
          currently causes x86 to fail to boot.
 
+config UBSAN_POINTER_WRAP
+       bool "Perform checking for pointer arithmetic wrap-around"
+       depends on !COMPILE_TEST
+       depends on $(cc-option,-fsanitize=pointer-overflow)
+       help
+         This option enables -fsanitize=pointer-overflow which checks
+         for wrap-around of any arithmetic operations with pointers.
+
 config UBSAN_BOOL
        bool "Perform checking for non-boolean values used as boolean"
        default UBSAN
diff --git a/lib/test_ubsan.c b/lib/test_ubsan.c
index 84d8092d6c32..1cc049b3ef34 100644
--- a/lib/test_ubsan.c
+++ b/lib/test_ubsan.c
@@ -56,6 +56,36 @@ static void test_ubsan_negate_overflow(void)
        val = -val;
 }
 
+static void test_ubsan_pointer_overflow_add(void)
+{
+       volatile void *top = (void *)ULONG_MAX;
+
+       UBSAN_TEST(CONFIG_UBSAN_POINTER_WRAP);
+       top += 2;
+}
+
+static void test_ubsan_pointer_overflow_sub(void)
+{
+       volatile void *bottom = (void *)1;
+
+       UBSAN_TEST(CONFIG_UBSAN_POINTER_WRAP);
+       bottom -= 3;
+}
+
+struct ptr_wrap {
+       int a;
+       int b;
+};
+
+static void test_ubsan_pointer_overflow_mul(void)
+{
+       volatile struct ptr_wrap *half = (void *)(ULONG_MAX - 128);
+       volatile int bump = 128;
+
+       UBSAN_TEST(CONFIG_UBSAN_POINTER_WRAP);
+       half += bump;
+}
+
 static void test_ubsan_divrem_overflow(void)
 {
        volatile int val = 16;
@@ -139,6 +169,9 @@ static const test_ubsan_fp test_ubsan_array[] = {
        test_ubsan_sub_overflow,
        test_ubsan_mul_overflow,
        test_ubsan_negate_overflow,
+       test_ubsan_pointer_overflow_add,
+       test_ubsan_pointer_overflow_sub,
+       test_ubsan_pointer_overflow_mul,
        test_ubsan_shift_out_of_bounds,
        test_ubsan_out_of_bounds,
        test_ubsan_load_invalid_value,
diff --git a/lib/ubsan.c b/lib/ubsan.c
index 5fc107f61934..d49580ff6aea 100644
--- a/lib/ubsan.c
+++ b/lib/ubsan.c
@@ -289,6 +289,27 @@ void __ubsan_handle_negate_overflow(void *_data, void 
*old_val)
 }
 EXPORT_SYMBOL(__ubsan_handle_negate_overflow);
 
+void __ubsan_handle_pointer_overflow(void *_data, void *lhs, void *rhs)
+{
+       struct overflow_data *data = _data;
+       unsigned long before = (unsigned long)lhs;
+       unsigned long after  = (unsigned long)rhs;
+
+       if (suppress_report(&data->location))
+               return;
+
+       ubsan_prologue(&data->location, "pointer-overflow");
+
+       if (after == 0)
+               pr_err("overflow wrapped to NULL\n");
+       else if (after < before)
+               pr_err("overflow wrap-around\n");
+       else
+               pr_err("underflow wrap-around\n");
+
+       ubsan_epilogue();
+}
+EXPORT_SYMBOL(__ubsan_handle_pointer_overflow);
 
 void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs)
 {
diff --git a/lib/ubsan.h b/lib/ubsan.h
index 0abbbac8700d..5dd27923b78b 100644
--- a/lib/ubsan.h
+++ b/lib/ubsan.h
@@ -128,6 +128,7 @@ void __ubsan_handle_add_overflow(void *data, void *lhs, 
void *rhs);
 void __ubsan_handle_sub_overflow(void *data, void *lhs, void *rhs);
 void __ubsan_handle_mul_overflow(void *data, void *lhs, void *rhs);
 void __ubsan_handle_negate_overflow(void *_data, void *old_val);
+void __ubsan_handle_pointer_overflow(void *_data, void *lhs, void *rhs);
 void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs);
 void __ubsan_handle_type_mismatch(struct type_mismatch_data *data, void *ptr);
 void __ubsan_handle_type_mismatch_v1(void *_data, void *ptr);
diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan
index 7b2f3d554c59..df4ccf063f67 100644
--- a/scripts/Makefile.ubsan
+++ b/scripts/Makefile.ubsan
@@ -10,6 +10,7 @@ ubsan-cflags-$(CONFIG_UBSAN_DIV_ZERO)         += 
-fsanitize=integer-divide-by-zero
 ubsan-cflags-$(CONFIG_UBSAN_UNREACHABLE)       += -fsanitize=unreachable
 ubsan-cflags-$(CONFIG_UBSAN_SIGNED_WRAP)       += 
-fsanitize=signed-integer-overflow
 ubsan-cflags-$(CONFIG_UBSAN_UNSIGNED_WRAP)     += 
-fsanitize=unsigned-integer-overflow
+ubsan-cflags-$(CONFIG_UBSAN_POINTER_WRAP)      += -fsanitize=pointer-overflow
 ubsan-cflags-$(CONFIG_UBSAN_BOOL)              += -fsanitize=bool
 ubsan-cflags-$(CONFIG_UBSAN_ENUM)              += -fsanitize=enum
 ubsan-cflags-$(CONFIG_UBSAN_TRAP)              += $(call 
cc-option,-fsanitize-trap=undefined,-fsanitize-undefined-trap-on-error)
-- 
2.34.1


Reply via email to