Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1556557 > unrolled thread

[PATCH] lkdtm: hide stack overflow warning for corrupt-stack test

Back to article view | Back to linux.kernel

Contents

  [PATCH] lkdtm: hide stack overflow warning for corrupt-stack test Arnd Bergmann <arnd@arndb.de> - 2017-01-11 16:00 +0100
    Re: [PATCH] lkdtm: hide stack overflow warning for corrupt-stack test Kees Cook <keescook@chromium.org> - 2017-01-11 17:40 +0100
    Re: [PATCH] lkdtm: hide stack overflow warning for corrupt-stack test Michael Ellerman <mpe@ellerman.id.au> - 2017-01-16 11:30 +0100

#1556557 — [PATCH] lkdtm: hide stack overflow warning for corrupt-stack test

After the latest change to make sure the compiler actually does a memset,
it is now smart enough to flag the stack overflow at compile time,
at least with gcc-7.0:

drivers/misc/lkdtm_bugs.c: In function 'lkdtm_CORRUPT_STACK':
drivers/misc/lkdtm_bugs.c:88:144: warning: 'memset' writing 64 bytes into a region of size 8 overflows the destination [-Wstringop-overflow=]

To outsmart the compiler again, this moves the memset into a noinline
function where (for now) it doesn't see that we intentionally write
broken code here.

Fixes: c55d240003ae ("lkdtm: Prevent the compiler from optimising lkdtm_CORRUPT_STACK()")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 drivers/misc/lkdtm_bugs.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/misc/lkdtm_bugs.c b/drivers/misc/lkdtm_bugs.c
index 91edd0b55e5c..bb3bb8ef5f44 100644
--- a/drivers/misc/lkdtm_bugs.c
+++ b/drivers/misc/lkdtm_bugs.c
@@ -80,12 +80,17 @@ void lkdtm_OVERFLOW(void)
 	(void) recursive_loop(recur_count);
 }
 
+static noinline void __lkdtm_CORRUPT_STACK(void *stack)
+{
+	memset(stack, 'a', 64);
+}
+
 noinline void lkdtm_CORRUPT_STACK(void)
 {
 	/* Use default char array length that triggers stack protection. */
 	char data[8];
+	__lkdtm_CORRUPT_STACK(&data);
 
-	memset((void *)data, 'a', 64);
 	pr_info("Corrupted stack with '%16s'...\n", data);
 }
 
-- 
2.9.0

[toc] | [next] | [standalone]

#1556701

On Wed, Jan 11, 2017 at 6:56 AM, Arnd Bergmann <arnd@arndb.de> wrote:
> After the latest change to make sure the compiler actually does a memset,
> it is now smart enough to flag the stack overflow at compile time,
> at least with gcc-7.0:
>
> drivers/misc/lkdtm_bugs.c: In function 'lkdtm_CORRUPT_STACK':
> drivers/misc/lkdtm_bugs.c:88:144: warning: 'memset' writing 64 bytes into a region of size 8 overflows the destination [-Wstringop-overflow=]
>
> To outsmart the compiler again, this moves the memset into a noinline
> function where (for now) it doesn't see that we intentionally write
> broken code here.
>
> Fixes: c55d240003ae ("lkdtm: Prevent the compiler from optimising lkdtm_CORRUPT_STACK()")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Hah. Yes, works for me. :)

Acked-by: Kees Cook <keescook@chromium.org>

-Kees

> ---
>  drivers/misc/lkdtm_bugs.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/misc/lkdtm_bugs.c b/drivers/misc/lkdtm_bugs.c
> index 91edd0b55e5c..bb3bb8ef5f44 100644
> --- a/drivers/misc/lkdtm_bugs.c
> +++ b/drivers/misc/lkdtm_bugs.c
> @@ -80,12 +80,17 @@ void lkdtm_OVERFLOW(void)
>         (void) recursive_loop(recur_count);
>  }
>
> +static noinline void __lkdtm_CORRUPT_STACK(void *stack)
> +{
> +       memset(stack, 'a', 64);
> +}
> +
>  noinline void lkdtm_CORRUPT_STACK(void)
>  {
>         /* Use default char array length that triggers stack protection. */
>         char data[8];
> +       __lkdtm_CORRUPT_STACK(&data);
>
> -       memset((void *)data, 'a', 64);
>         pr_info("Corrupted stack with '%16s'...\n", data);
>  }
>
> --
> 2.9.0
>



-- 
Kees Cook
Nexus Security

[toc] | [prev] | [next] | [standalone]

#1559603

Arnd Bergmann <arnd@arndb.de> writes:

> After the latest change to make sure the compiler actually does a memset,
> it is now smart enough to flag the stack overflow at compile time,
> at least with gcc-7.0:
>
> drivers/misc/lkdtm_bugs.c: In function 'lkdtm_CORRUPT_STACK':
> drivers/misc/lkdtm_bugs.c:88:144: warning: 'memset' writing 64 bytes into a region of size 8 overflows the destination [-Wstringop-overflow=]
>
> To outsmart the compiler again, this moves the memset into a noinline
> function where (for now) it doesn't see that we intentionally write
> broken code here.

Heh, darn it.

I suspect this is an arms race we are eventually going to lose. At some
point we might have to switch to writing some of these in asm :/

cheers

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web