@@ -293,12 +293,17 @@ struct ftrace_likely_data {
#else
# define __unsigned_wrap
#endif
+#ifdef CONFIG_UBSAN_POINTER_WRAP
+# define __pointer_wrap __attribute__((no_sanitize("pointer-overflow")))
+#else
+# define __pointer_wrap
+#endif
/* Section for code which can't be instrumented at all */
#define __noinstr_section(section) \
noinline notrace __attribute((__section__(section))) \
__no_kcsan __no_sanitize_address __no_profile __no_sanitize_coverage \
- __no_sanitize_memory __signed_wrap __unsigned_wrap
+ __no_sanitize_memory __signed_wrap __unsigned_wrap __pointer_wrap
#define noinstr __noinstr_section(".noinstr.text")
@@ -135,6 +135,14 @@ config UBSAN_UNSIGNED_WRAP
for wrap-around of any arithmetic operations with unsigned integers. This
currently causes x86 to fail to boot.
+config UBSAN_POINTER_WRAP
+ bool "Perform checking for pointer arithmetic wrap-around"
+ depends on !COMPILE_TEST
+ depends on $(cc-option,-fsanitize=pointer-overflow)
+ help
+ This option enables -fsanitize=pointer-overflow which checks
+ for wrap-around of any arithmetic operations with pointers.
+
config UBSAN_BOOL
bool "Perform checking for non-boolean values used as boolean"
default UBSAN
@@ -56,6 +56,36 @@ static void test_ubsan_negate_overflow(void)
val = -val;
}
+static void test_ubsan_pointer_overflow_add(void)
+{
+ volatile void *top = (void *)ULONG_MAX;
+
+ UBSAN_TEST(CONFIG_UBSAN_POINTER_WRAP);
+ top += 2;
+}
+
+static void test_ubsan_pointer_overflow_sub(void)
+{
+ volatile void *bottom = (void *)1;
+
+ UBSAN_TEST(CONFIG_UBSAN_POINTER_WRAP);
+ bottom -= 3;
+}
+
+struct ptr_wrap {
+ int a;
+ int b;
+};
+
+static void test_ubsan_pointer_overflow_mul(void)
+{
+ volatile struct ptr_wrap *half = (void *)(ULONG_MAX - 128);
+ volatile int bump = 128;
+
+ UBSAN_TEST(CONFIG_UBSAN_POINTER_WRAP);
+ half += bump;
+}
+
static void test_ubsan_divrem_overflow(void)
{
volatile int val = 16;
@@ -139,6 +169,9 @@ static const test_ubsan_fp test_ubsan_array[] = {
test_ubsan_sub_overflow,
test_ubsan_mul_overflow,
test_ubsan_negate_overflow,
+ test_ubsan_pointer_overflow_add,
+ test_ubsan_pointer_overflow_sub,
+ test_ubsan_pointer_overflow_mul,
test_ubsan_shift_out_of_bounds,
test_ubsan_out_of_bounds,
test_ubsan_load_invalid_value,
@@ -289,6 +289,27 @@ void __ubsan_handle_negate_overflow(void *_data, void *old_val)
}
EXPORT_SYMBOL(__ubsan_handle_negate_overflow);
+void __ubsan_handle_pointer_overflow(void *_data, void *lhs, void *rhs)
+{
+ struct overflow_data *data = _data;
+ unsigned long before = (unsigned long)lhs;
+ unsigned long after = (unsigned long)rhs;
+
+ if (suppress_report(&data->location))
+ return;
+
+ ubsan_prologue(&data->location, "pointer-overflow");
+
+ if (after == 0)
+ pr_err("overflow wrapped to NULL\n");
+ else if (after < before)
+ pr_err("overflow wrap-around\n");
+ else
+ pr_err("underflow wrap-around\n");
+
+ ubsan_epilogue();
+}
+EXPORT_SYMBOL(__ubsan_handle_pointer_overflow);
void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs)
{
@@ -128,6 +128,7 @@ void __ubsan_handle_add_overflow(void *data, void *lhs, void *rhs);
void __ubsan_handle_sub_overflow(void *data, void *lhs, void *rhs);
void __ubsan_handle_mul_overflow(void *data, void *lhs, void *rhs);
void __ubsan_handle_negate_overflow(void *_data, void *old_val);
+void __ubsan_handle_pointer_overflow(void *_data, void *lhs, void *rhs);
void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs);
void __ubsan_handle_type_mismatch(struct type_mismatch_data *data, void *ptr);
void __ubsan_handle_type_mismatch_v1(void *_data, void *ptr);
@@ -10,6 +10,7 @@ ubsan-cflags-$(CONFIG_UBSAN_DIV_ZERO) += -fsanitize=integer-divide-by-zero
ubsan-cflags-$(CONFIG_UBSAN_UNREACHABLE) += -fsanitize=unreachable
ubsan-cflags-$(CONFIG_UBSAN_SIGNED_WRAP) += -fsanitize=signed-integer-overflow
ubsan-cflags-$(CONFIG_UBSAN_UNSIGNED_WRAP) += -fsanitize=unsigned-integer-overflow
+ubsan-cflags-$(CONFIG_UBSAN_POINTER_WRAP) += -fsanitize=pointer-overflow
ubsan-cflags-$(CONFIG_UBSAN_BOOL) += -fsanitize=bool
ubsan-cflags-$(CONFIG_UBSAN_ENUM) += -fsanitize=enum
ubsan-cflags-$(CONFIG_UBSAN_TRAP) += $(call cc-option,-fsanitize-trap=undefined,-fsanitize-undefined-trap-on-error)
Gain coverage for pointer wrap-around checking. Adds support for -fsanitize=pointer-overflow, and introduces the __pointer_wrap function attribute to match the signed and unsigned attributes. Also like the others, it is currently disabled under CONFIG_COMPILE_TEST. Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Masahiro Yamada <masahiroy@kernel.org> Cc: Nathan Chancellor <nathan@kernel.org> Cc: Nicolas Schier <nicolas@fjasle.eu> Cc: linux-kbuild@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> --- include/linux/compiler_types.h | 7 ++++++- lib/Kconfig.ubsan | 8 ++++++++ lib/test_ubsan.c | 33 +++++++++++++++++++++++++++++++++ lib/ubsan.c | 21 +++++++++++++++++++++ lib/ubsan.h | 1 + scripts/Makefile.ubsan | 1 + 6 files changed, 70 insertions(+), 1 deletion(-)