From patchwork Thu Jan 16 01:23:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11335781 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5F94C13BD for ; Thu, 16 Jan 2020 01:24:26 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 1FA842084D for ; Thu, 16 Jan 2020 01:24:26 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="Oy7tVeYN" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1FA842084D Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id EEE118E0018; Wed, 15 Jan 2020 20:24:23 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id E32228E0017; Wed, 15 Jan 2020 20:24:23 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CC9D78E0017; Wed, 15 Jan 2020 20:24:23 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0211.hostedemail.com [216.40.44.211]) by kanga.kvack.org (Postfix) with ESMTP id B52BD8E0003 for ; Wed, 15 Jan 2020 20:24:23 -0500 (EST) Received: from smtpin24.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with SMTP id 57C4A181AEF00 for ; Thu, 16 Jan 2020 01:24:23 +0000 (UTC) X-FDA: 76381752006.24.cork34_7d8f3449aff3a X-Spam-Summary: 30,2,0,b7907f0ed43ac55b,d41d8cd98f00b204,keescook@chromium.org,:akpm@linux-foundation.org:keescook@chromium.org:lenaptr@google.com:dvyukov@google.com:aryabinin@virtuozzo.com:glider@google.com:dan.carpenter@oracle.com:gustavo@embeddedor.com:arnd@arndb.de:ard.biesheuvel@linaro.org:kasan-dev@googlegroups.com::linux-kernel@vger.kernel.org:kernel-hardening@lists.openwall.com:syzkaller@googlegroups.com,RULES_HIT:41:355:379:472:541:800:960:968:973:982:988:989:1260:1311:1314:1345:1359:1437:1515:1535:1544:1605:1711:1730:1747:1777:1792:2198:2199:2393:2553:2559:2562:2731:2736:2899:3138:3139:3140:3141:3142:3865:3866:3867:3868:3870:3871:3874:4118:4250:4321:4605:5007:6119:6261:6653:6742:6755:7903:8603:8660:8784:10004:11026:11232:11473:11658:11914:12043:12219:12296:12297:12438:12517:12519:12555:12895:12986:13148:13161:13221:13229:13230:13894:13972:14093:14096:14181:14394:14721:21080:21325:21433:21444:21451:21611:21627:21889:30012:30054:30062:30074:30089:30090,0,RBL:209.85.21 4.195:@c X-HE-Tag: cork34_7d8f3449aff3a X-Filterd-Recvd-Size: 7651 Received: from mail-pl1-f195.google.com (mail-pl1-f195.google.com [209.85.214.195]) by imf33.hostedemail.com (Postfix) with ESMTP for ; Thu, 16 Jan 2020 01:24:22 +0000 (UTC) Received: by mail-pl1-f195.google.com with SMTP id p9so7599607plk.9 for ; Wed, 15 Jan 2020 17:24:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=vuuIloFbVRb0p706sR0GRT1NGf5G9e2wBRiCGVrk15E=; b=Oy7tVeYNPp0hMeW43ro1kUxZsX6Njfchn0Sj8KLauamE0IQ5/ZcQQvued6aW9DGWR3 paKAkOW6vFMjIv5kwJMgb3gND1N355kK/DklI4mQTum8ktjUMFMsucit8FJWWHODr3VT XMEgVnvesouIuqJQTp6QooK7ke5EW6pbJuNPQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=vuuIloFbVRb0p706sR0GRT1NGf5G9e2wBRiCGVrk15E=; b=iI01LcR7fOHB1O5O/HkBLZAH8ggiZlKcc9tkxSLAiOPFR7NC2AClcgQIcuGQq3EejA 0Qs+cHBPmkv0PaUGp9RjaQGltg5VjBByqVzsoM7nkHmPMPP1XyUFajITcBZ194OW6j04 e6PYfOwpUkvUWl847MGApPzzGbsV5l2fgDtDTvbKnbp8rDAnoIcEKXNCcwzgymi+YAzf +bNIclT0joNZmX9BtXIGIeaYJr1OmCFgcdvcZbRTVTgsW0Q9lCq5uZgm0G4uXckIiW9K MCn/L0ec+RMaU6lIoa83v/kOIc3uDq14v3l1zwt4xRqVI5PQ9LtRzXpsjMQ5eQ0oNT22 0R+Q== X-Gm-Message-State: APjAAAUSsS+VTP6bu5CKK4HDb/sO+c1ZKRcCwgTCzSlC7dWUv8/10Zsy FkbYrG/Zy3Jz2a768dUHJ9OIUQ== X-Google-Smtp-Source: APXvYqyC9MlZJFpJmPX7iF7s8KlOdlx6EtYanuy9X2Oycwg3CfRRGIXJ/hs/r4iAQKjQ5AAGjmfBLg== X-Received: by 2002:a17:90b:258:: with SMTP id fz24mr3458273pjb.6.1579137861582; Wed, 15 Jan 2020 17:24:21 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id 189sm23827180pfw.73.2020.01.15.17.24.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jan 2020 17:24:18 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Elena Petrova , Dmitry Vyukov , Andrey Ryabinin , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v3 1/6] ubsan: Add trap instrumentation option Date: Wed, 15 Jan 2020 17:23:16 -0800 Message-Id: <20200116012321.26254-2-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200116012321.26254-1-keescook@chromium.org> References: <20200116012321.26254-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The Undefined Behavior Sanitizer can operate in two modes: warning reporting mode via lib/ubsan.c handler calls, or trap mode, which uses __builtin_trap() as the handler. Using lib/ubsan.c means the kernel image is about 5% larger (due to all the debugging text and reporting structures to capture details about the warning conditions). Using the trap mode, the image size changes are much smaller, though at the loss of the "warning only" mode. In order to give greater flexibility to system builders that want minimal changes to image size and are prepared to deal with kernel code being aborted and potentially destabilizing the system, this introduces CONFIG_UBSAN_TRAP. The resulting image sizes comparison: text data bss dec hex filename 19533663 6183037 18554956 44271656 2a38828 vmlinux.stock 19991849 7618513 18874448 46484810 2c54d4a vmlinux.ubsan 19712181 6284181 18366540 44362902 2a4ec96 vmlinux.ubsan-trap CONFIG_UBSAN=y: image +4.8% (text +2.3%, data +18.9%) CONFIG_UBSAN_TRAP=y: image +0.2% (text +0.9%, data +1.6%) Additionally adjusts the CONFIG_UBSAN Kconfig help for clarity and removes the mention of non-existing boot param "ubsan_handle". Suggested-by: Elena Petrova Signed-off-by: Kees Cook Acked-by: Dmitry Vyukov --- lib/Kconfig.ubsan | 22 ++++++++++++++++++---- lib/Makefile | 2 ++ scripts/Makefile.ubsan | 9 +++++++-- 3 files changed, 27 insertions(+), 6 deletions(-) diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan index 0e04fcb3ab3d..9deb655838b0 100644 --- a/lib/Kconfig.ubsan +++ b/lib/Kconfig.ubsan @@ -5,11 +5,25 @@ config ARCH_HAS_UBSAN_SANITIZE_ALL config UBSAN bool "Undefined behaviour sanity checker" help - This option enables undefined behaviour sanity checker + This option enables the Undefined Behaviour sanity checker. Compile-time instrumentation is used to detect various undefined - behaviours in runtime. Various types of checks may be enabled - via boot parameter ubsan_handle - (see: Documentation/dev-tools/ubsan.rst). + behaviours at runtime. For more details, see: + Documentation/dev-tools/ubsan.rst + +config UBSAN_TRAP + bool "On Sanitizer warnings, abort the running kernel code" + depends on UBSAN + depends on $(cc-option, -fsanitize-undefined-trap-on-error) + help + Building kernels with Sanitizer features enabled tends to grow + the kernel size by around 5%, due to adding all the debugging + text on failure paths. To avoid this, Sanitizer instrumentation + can just issue a trap. This reduces the kernel size overhead but + turns all warnings (including potentially harmless conditions) + into full exceptions that abort the running kernel code + (regardless of context, locks held, etc), which may destabilize + the system. For some system builders this is an acceptable + trade-off. config UBSAN_SANITIZE_ALL bool "Enable instrumentation for the entire kernel" diff --git a/lib/Makefile b/lib/Makefile index 93217d44237f..3114ef1727f8 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -275,7 +275,9 @@ quiet_cmd_build_OID_registry = GEN $@ clean-files += oid_registry_data.c obj-$(CONFIG_UCS2_STRING) += ucs2_string.o +ifneq ($(CONFIG_UBSAN_TRAP),y) obj-$(CONFIG_UBSAN) += ubsan.o +endif UBSAN_SANITIZE_ubsan.o := n KASAN_SANITIZE_ubsan.o := n diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan index 019771b845c5..668a91510bfe 100644 --- a/scripts/Makefile.ubsan +++ b/scripts/Makefile.ubsan @@ -1,5 +1,10 @@ # SPDX-License-Identifier: GPL-2.0 ifdef CONFIG_UBSAN + +ifdef CONFIG_UBSAN_ALIGNMENT + CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment) +endif + CFLAGS_UBSAN += $(call cc-option, -fsanitize=shift) CFLAGS_UBSAN += $(call cc-option, -fsanitize=integer-divide-by-zero) CFLAGS_UBSAN += $(call cc-option, -fsanitize=unreachable) @@ -9,8 +14,8 @@ ifdef CONFIG_UBSAN CFLAGS_UBSAN += $(call cc-option, -fsanitize=bool) CFLAGS_UBSAN += $(call cc-option, -fsanitize=enum) -ifdef CONFIG_UBSAN_ALIGNMENT - CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment) +ifdef CONFIG_UBSAN_TRAP + CFLAGS_UBSAN += $(call cc-option, -fsanitize-undefined-trap-on-error) endif # -fsanitize=* options makes GCC less smart than usual and