linux-toradex.git/scripts/Makefile.ubsan, branch v6.15-rc5

ubsan/overflow: Enable ignorelist parsing and add type filter

2025-03-08T03:58:05+00:00

Limit integer wrap-around mitigation to only the "size_t" type (for
now). Notably this covers all special functions/builtins that return
"size_t", like sizeof(). This remains an experimental feature and is
likely to be replaced with type annotations.

Reviewed-by: Justin Stitt 
Link: https://lore.kernel.org/r/20250307041914.937329-3-kees@kernel.org
Signed-off-by: Kees Cook

ubsan/overflow: Enable pattern exclusions

2025-03-08T03:58:05+00:00

To make integer wrap-around mitigation actually useful, the associated
sanitizers must not instrument cases where the wrap-around is explicitly
defined (e.g. "-2UL"), being tested for (e.g. "if (a + b < a)"), or
where it has no impact on code flow (e.g. "while (var--)"). Enable
pattern exclusions for the integer wrap sanitizers.

Reviewed-by: Justin Stitt 
Link: https://lore.kernel.org/r/20250307041914.937329-2-kees@kernel.org
Signed-off-by: Kees Cook

ubsan/overflow: Rework integer overflow sanitizer option to turn on everything

2025-03-08T03:58:05+00:00

Since we're going to approach integer overflow mitigation a type at a
time, we need to enable all of the associated sanitizers, and then opt
into types one at a time.

Rename the existing "signed wrap" sanitizer to just the entire topic area:
"integer wrap". Enable the implicit integer truncation sanitizers, with
required callbacks and tests.

Notably, this requires features (currently) only available in Clang,
so we can depend on the cc-option tests to determine availability
instead of doing version tests.

Link: https://lore.kernel.org/r/20250307041914.937329-1-kees@kernel.org
Signed-off-by: Kees Cook

ubsan: Reintroduce signed overflow sanitizer

2024-02-21T04:44:49+00:00

In order to mitigate unexpected signed wrap-around[1], bring back the
signed integer overflow sanitizer. It was removed in commit 6aaa31aeb9cf
("ubsan: remove overflow checks") because it was effectively a no-op
when combined with -fno-strict-overflow (which correctly changes signed
overflow from being "undefined" to being explicitly "wrap around").

Compilers are adjusting their sanitizers to trap wrap-around and to
detecting common code patterns that should not be instrumented
(e.g. "var + offset < var"). Prepare for this and explicitly rename
the option from "OVERFLOW" to "WRAP" to more accurately describe the
behavior.

To annotate intentional wrap-around arithmetic, the helpers
wrapping_add/sub/mul_wrap() can be used for individual statements. At
the function level, the __signed_wrap attribute can be used to mark an
entire function as expecting its signed arithmetic to wrap around. For a
single object file the Makefile can use "UBSAN_SIGNED_WRAP_target.o := n"
to mark it as wrapping, and for an entire directory, "UBSAN_SIGNED_WRAP :=
n" can be used.

Additionally keep these disabled under CONFIG_COMPILE_TEST for now.

Link: https://github.com/KSPP/linux/issues/26 [1]
Cc: Miguel Ojeda 
Cc: Nathan Chancellor 
Cc: Peter Zijlstra 
Cc: Hao Luo 
Reviewed-by: Marco Elver 
Reviewed-by: Justin Stitt 
Signed-off-by: Kees Cook

ubsan: Use Clang's -fsanitize-trap=undefined option

2024-02-06T10:21:38+00:00

Clang changed the way it enables UBSan trapping mode. Update the Makefile
logic to discover it.

Suggested-by: Fangrui Song 
Link: https://lore.kernel.org/lkml/CAFP8O3JivZh+AAV7N90Nk7U2BHRNST6MRP0zHtfQ-Vj0m4+pDA@mail.gmail.com/
Reviewed-by: Fangrui Song 
Reviewed-by: Justin Stitt 
Cc: Nathan Chancellor 
Cc: Masahiro Yamada 
Cc: Nicolas Schier 
Cc: Nick Desaulniers 
Cc: Bill Wendling 
Cc: linux-kbuild@vger.kernel.org
Cc: llvm@lists.linux.dev
Signed-off-by: Kees Cook

ubsan: Tighten UBSAN_BOUNDS on GCC

2023-05-16T20:57:14+00:00

The use of -fsanitize=bounds on GCC will ignore some trailing arrays,
leaving a gap in coverage. Switch to using -fsanitize=bounds-strict to
match Clang's stricter behavior.

Cc: Marco Elver 
Cc: Masahiro Yamada 
Cc: Nathan Chancellor 
Cc: Nick Desaulniers 
Cc: Nicolas Schier 
Cc: Tom Rix 
Cc: Josh Poimboeuf 
Cc: Miroslav Benes 
Cc: linux-kbuild@vger.kernel.org
Cc: llvm@lists.linux.dev
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20230405022356.gonna.338-kees@kernel.org

ubsan: remove CONFIG_UBSAN_OBJECT_SIZE

2022-01-20T06:52:55+00:00

The object-size sanitizer is redundant to -Warray-bounds, and
inappropriately performs its checks at run-time when all information
needed for the evaluation is available at compile-time, making it quite
difficult to use:

  https://bugzilla.kernel.org/show_bug.cgi?id=214861

With -Warray-bounds almost enabled globally, it doesn't make sense to
keep this around.

Link: https://lkml.kernel.org/r/20211203235346.110809-1-keescook@chromium.org
Signed-off-by: Kees Cook 
Reviewed-by: Marco Elver 
Cc: Masahiro Yamada 
Cc: Michal Marek 
Cc: Nick Desaulniers 
Cc: Nathan Chancellor 
Cc: Andrey Ryabinin 
Cc: "Peter Zijlstra (Intel)" 
Cc: Stephen Rothwell 
Cc: Arnd Bergmann 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ubsan: remove overflow checks

2021-02-26T17:41:05+00:00

Since GCC 8.0 -fsanitize=signed-integer-overflow doesn't work with
-fwrapv.  -fwrapv makes signed overflows defines and GCC essentially
disables ubsan checks.  On GCC < 8.0 -fwrapv doesn't have influence on
-fsanitize=signed-integer-overflow setting, so it kinda works but
generates false-positves and violates uaccess rules:

lib/iov_iter.o: warning: objtool: iovec_from_user()+0x22d: call to
__ubsan_handle_add_overflow() with UACCESS enabled

Disable signed overflow checks to avoid these problems.  Remove unsigned
overflow checks as well.  Unsigned overflow appeared as side effect of
commit cdf8a76fda4a ("ubsan: move cc-option tests into Kconfig"), but it
never worked (kernel doesn't boot).  And unsigned overflows are allowed by
C standard, so it just pointless.

Link: https://lkml.kernel.org/r/20210209232348.20510-1-ryabinin.a.a@gmail.com
Signed-off-by: Andrey Ryabinin 
Acked-by: Peter Zijlstra (Intel) 
Cc: Josh Poimboeuf 
Cc: Randy Dunlap 
Cc: Stephen Rothwell 
Cc: Dmitry Vyukov 
Cc: Kees Cook 
Cc: Alexander Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ubsan: move cc-option tests into Kconfig

2020-12-16T06:46:18+00:00

Instead of doing if/endif blocks with cc-option calls in the UBSAN
Makefile, move all the tests into Kconfig and use the Makefile to collect
the results.

Link: https://lkml.kernel.org/r/20201203004437.389959-3-keescook@chromium.org
Link: https://lore.kernel.org/lkml/CAHk-=wjPasyJrDuwDnpHJS2TuQfExwe=px-SzLeN8GFMAQJPmQ@mail.gmail.com/
Signed-off-by: Kees Cook 
Suggested-by: Linus Torvalds 
Reviewed-by: Nathan Chancellor 
Tested-by: Nathan Chancellor 
Cc: Andrey Ryabinin 
Cc: Ard Biesheuvel 
Cc: Arnd Bergmann 
Cc: Dmitry Vyukov 
Cc: George Popescu 
Cc: Herbert Xu 
Cc: Marco Elver 
Cc: Masahiro Yamada 
Cc: Michal Marek 
Cc: Nick Desaulniers 
Cc: Peter Oberparleiter 
Cc: Randy Dunlap 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ubsan: remove redundant -Wno-maybe-uninitialized

2020-12-16T06:46:18+00:00

Patch series "Clean up UBSAN Makefile", v2.

This series attempts to address the issues seen with UBSAN's object-size
sanitizer causing problems under GCC.  In the process, the Kconfig and
Makefile are refactored to do all the cc-option calls in the Kconfig.
Additionally start to detangle -Wno-maybe-uninitialized, disable
UBSAN_TRAP under COMPILE_TEST for wider build coverage, and expand the
libusan tests.

This patch (of 7):

In commit 78a5255ffb6a ("Stop the ad-hoc games with
-Wno-maybe-initialized") -Wmaybe-uninitialized was disabled globally, so
keeping the disabling logic here too doesn't make sense.

Link: https://lkml.kernel.org/r/20201203004437.389959-1-keescook@chromium.org
Link: https://lkml.kernel.org/r/20201203004437.389959-2-keescook@chromium.org
Signed-off-by: Kees Cook 
Cc: Linus Torvalds 
Cc: Ard Biesheuvel 
Cc: Arnd Bergmann 
Cc: Masahiro Yamada 
Cc: Michal Marek 
Cc: Nathan Chancellor 
Cc: Nick Desaulniers 
Cc: Marco Elver 
Cc: Randy Dunlap 
Cc: Dmitry Vyukov 
Cc: George Popescu 
Cc: Herbert Xu 
Cc: Peter Oberparleiter 
Cc: Andrey Ryabinin 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds