From patchwork Wed Feb 1 20:05:11 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 9550615 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E8DFC60236 for ; Wed, 1 Feb 2017 20:05:31 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DCAA428464 for ; Wed, 1 Feb 2017 20:05:31 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D1B3F2846F; Wed, 1 Feb 2017 20:05:31 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id A463428464 for ; Wed, 1 Feb 2017 20:05:29 +0000 (UTC) Received: (qmail 11874 invoked by uid 550); 1 Feb 2017 20:05:27 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 11823 invoked from network); 1 Feb 2017 20:05:25 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:mime-version:content-disposition :content-transfer-encoding; bh=h/sEHlYxCSYTC6VN4O1wguYb+E00olyH+FiG6nyR94o=; b=J9ZAtWnWQXur4e2J5PrNpRbDdFBu4/vcr6n78sUxkhqZFZvlyZZhahT68Iq3tZx3dU sOVTiSptbO0A6JtAZcDJVZVdpwrCqQOFennhjTInICMokjj4wjn9cdm+obN+DZAgq1lf FSnHiUMIVVY7Z864GZ+HhmS7wxibaJ6i198JI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:content-transfer-encoding; bh=h/sEHlYxCSYTC6VN4O1wguYb+E00olyH+FiG6nyR94o=; b=UBf/rzyEwOPIBXe2BfFXEroOy8hzRKTRpkAFApybKl3uLsbMiPCvkLBM36wBUvSKMp D4JQwtdONP0ZAtVEgB6fgIkSBBPHlC148He5XNmG4m8ZadxRgbTqv6MxAINQdOcozsZF bT6+xXf8fyvjKPBpoYhfM3w2QQ6fOSNQoHrQ9g9zwqDOMyJB970vya7P1kKlBcP9UCMZ FxWIhfWFqh6Ij4+cZtMb3fpyL+9t4+mAJ4xxbt+wOMuRBFeuR4kKopIaxiieaupxrN+4 bK22DT0eqJmelLxPu4zuBKwK+PUQjW6to0BSIsEyhvuBnbRSIsXeRxJjXGR+Sb2bDBWY Ssqg== X-Gm-Message-State: AIkVDXJqEQleq2sXiUEKipTdI3UTlzMbd9HzJCVJ+anRqplm24jR/CH18YQqQsOgOHCdBd8G X-Received: by 10.84.238.203 with SMTP id l11mr6865801pln.95.1485979513304; Wed, 01 Feb 2017 12:05:13 -0800 (PST) Date: Wed, 1 Feb 2017 12:05:11 -0800 From: Kees Cook To: Brad Spengler Cc: PaX Team , Emese Revfy , kernel-hardening@lists.openwall.com Message-ID: <20170201200511.GA25426@beast> MIME-Version: 1.0 Content-Disposition: inline Subject: [kernel-hardening] [PATCH] randstruct: deal with char array casts X-Virus-Scanned: ClamAV using ClamSMTP In continuing to poke at upstreaming randstruct, I noticed build warnings that exist even under a normal grsecurity build: fs/nfs/namespace.c: In function ‘nfs_do_submount’: fs/nfs/namespace.c:261:6: note: found mismatched struct pointer types: ‘struct vfsmount’ and ‘char’   mnt = (struct vfsmount *)devname;       ^ devname is a char *:         devname = nfs_devname(dentry, page, PAGE_SIZE);         mnt = (struct vfsmount *)devname; net/unix/af_unix.c: In function ‘unix_skb_scm_eq’: net/unix/af_unix.c:1634:31: note: found mismatched struct pointer types: ‘struct unix_skb_parms’ and ‘char’   const struct unix_skb_parms *u = &UNIXCB(skb);                                ^ UNIXCB is: #define UNIXCB(skb)     (*(struct unix_skb_parms *)&((skb)->cb)) And ->cb is:         char                    cb[48] __aligned(8); Both of these are kind of crazy casts, but it looks like they'd always be "safe" under randomized structure layout (in that it's being cast out of a character array). This silences the specific case and updates the warnings to be more specific. Signed-off-by: Kees Cook --- scripts/gcc-plugins/randomize_layout_plugin.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/scripts/gcc-plugins/randomize_layout_plugin.c b/scripts/gcc-plugins/randomize_layout_plugin.c index 71911c828aae..1f62fabc1141 100644 --- a/scripts/gcc-plugins/randomize_layout_plugin.c +++ b/scripts/gcc-plugins/randomize_layout_plugin.c @@ -664,7 +664,7 @@ static void check_bad_casts_in_constructor(tree var, tree init) if (!lookup_attribute("randomize_performed", TYPE_ATTRIBUTES(val_type))) continue; - inform(DECL_SOURCE_LOCATION(var), "found mismatched struct pointer types: %qT and %qT\n", TYPE_MAIN_VARIANT(field_type), TYPE_MAIN_VARIANT(val_type)); + inform(DECL_SOURCE_LOCATION(var), "found mismatched constructor struct pointer types: %qT and %qT\n", TYPE_MAIN_VARIANT(field_type), TYPE_MAIN_VARIANT(val_type)); } } @@ -830,10 +830,13 @@ static unsigned int find_bad_casts_execute(void) continue; if (TREE_CODE(ptr_rhs_type) != RECORD_TYPE) { + /* Ignore casts from char arrays. */ + if (ptr_rhs_type == char_type_node) + continue; #ifndef __DEBUG_PLUGIN if (lookup_attribute("randomize_performed", TYPE_ATTRIBUTES(ptr_lhs_type))) #endif - inform(gimple_location(stmt), "found mismatched struct pointer types: %qT and %qT\n", ptr_lhs_type, ptr_rhs_type); + inform(gimple_location(stmt), "found mismatched rhs struct pointer types: %qT and %qT\n", ptr_lhs_type, ptr_rhs_type); continue; } @@ -856,7 +859,7 @@ static unsigned int find_bad_casts_execute(void) #ifndef __DEBUG_PLUGIN if (lookup_attribute("randomize_performed", TYPE_ATTRIBUTES(op0_type))) #endif - inform(gimple_location(stmt), "found mismatched struct pointer types: %qT and %qT\n", ptr_lhs_type, op0_type); + inform(gimple_location(stmt), "found mismatched op0 struct pointer types: %qT and %qT\n", ptr_lhs_type, op0_type); } else { const_tree ssa_name_var = SSA_NAME_VAR(rhs1); /* skip bogus type casts introduced by container_of */ @@ -866,7 +869,7 @@ static unsigned int find_bad_casts_execute(void) #ifndef __DEBUG_PLUGIN if (lookup_attribute("randomize_performed", TYPE_ATTRIBUTES(ptr_rhs_type))) #endif - inform(gimple_location(stmt), "found mismatched struct pointer types: %qT and %qT\n", ptr_lhs_type, ptr_rhs_type); + inform(gimple_location(stmt), "found mismatched ssa struct pointer types: %qT and %qT\n", ptr_lhs_type, ptr_rhs_type); } }