From patchwork Tue Jan 23 00:27:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13526677 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2747C46CD2 for ; Tue, 23 Jan 2024 00:36:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 456408D0002; Mon, 22 Jan 2024 19:36:21 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 3DEF98D0001; Mon, 22 Jan 2024 19:36:21 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 27FA28D0002; Mon, 22 Jan 2024 19:36:21 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 153FA8D0001 for ; Mon, 22 Jan 2024 19:36:21 -0500 (EST) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id B3D1C12099E for ; Tue, 23 Jan 2024 00:36:20 +0000 (UTC) X-FDA: 81708709320.22.41502DF Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) by imf21.hostedemail.com (Postfix) with ESMTP id C13371C000B for ; Tue, 23 Jan 2024 00:36:18 +0000 (UTC) Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=hhbUuuFd; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf21.hostedemail.com: domain of keescook@chromium.org designates 209.85.214.182 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1705970178; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=0NeuRUk433ZNKdRiqKX8mhaA8jznwDCQBGOUrYcR3Zw=; b=1wE4ALxowoE2z7ZxnbtHYuhvuVpVDBBNHX/h9K6WQ2F7ZImYfu+fTJNdj3ZDxmg9tcaEYo q1R30CCTQBSIbKLdFOcTcLl5Sa22NGCTyJhO9DWuUUK+k3ngwZE81G/n8+LQuQ0tf2jI1K HzfBj/E1/3Bgh+/MiY3AtUALMdp2/hI= ARC-Authentication-Results: i=1; imf21.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=hhbUuuFd; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf21.hostedemail.com: domain of keescook@chromium.org designates 209.85.214.182 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1705970178; a=rsa-sha256; cv=none; b=4CHfF01ru5bB5JO4z3zae8cZnY5C/VhetxDR5HsO5JtZVKD+RpMFZqMAIHdljfJA/5lE6p MYMPcyjcXLbuzuP2vIi7ui8jAr7sK8YLZShKzQy1TM+MaETS1tWFE0lCnnQusRcVyQYUnV MFyfIroQYFvQODUyRwDwel0neC2rd4Q= Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-1d748d43186so10836655ad.0 for ; Mon, 22 Jan 2024 16:36:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1705970177; x=1706574977; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=0NeuRUk433ZNKdRiqKX8mhaA8jznwDCQBGOUrYcR3Zw=; b=hhbUuuFdT5SOmbXqzLzS8kCBHxf1HCyzkpNYPgp0lGx2wdbk67sWX+1addwgW2c1dj y8tIgMUSuA0uYKwdmU1DtIVIw8eMP/olj3CPAU7MLN70f6oKGb6E/k1is5KBF3Vnwpbw pdn1ynSwnOZ9Gvv09uiF5Kespp4Fjy1B1Ztxk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1705970177; x=1706574977; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=0NeuRUk433ZNKdRiqKX8mhaA8jznwDCQBGOUrYcR3Zw=; b=teK1aWQKwUY1wu0og+7R7iw4dnBuK7bK4JGPm7S7Yq1vvICyMoDx+K3PGzfGaV1aV8 ayuHOtZ/sV8VGAI6w5q+lmYxfllyc5mXGR/Sqkc6Y1X1opMfjMo/8A8YNT0Nsw4lfJpX HVIqIK+aF0wkHiMujLYeTAKiKp9wmfjQ/uFwUaGbecCc2Az7O3Bda5KTincaBzw4WT6f cYxV3wQ+qFPc944eIsTuS3eSMh7hAsZ8ZhIL/qWG7Ycy3cDn6LMK8TPAccNbJxgEAfqb JPd209sdQNfkJi9nxUVYm7G/vj3RRh57CEyVx7O70o68nrGxmIyEWh+CUrnISIC912qQ JMOA== X-Gm-Message-State: AOJu0YxemL7pne7qyG0zR7q5Eqmw1nLAiE7zBHu1dJ8b/+DpeeCaKBUX NQ8FlOlyNeu4OlC/+qLAU3uYwibUDisVEQqXPTGjpvQDjA3DXNlVW6y9BIW+1N/ByB2c5mEC+II = X-Google-Smtp-Source: AGHT+IGzeIhLGStyUXkk+prqRHH7Hh0fJDcXpjpuBSpJSnr3lUskSGrUG6ndGqpvhP7k6BsWTy450Q== X-Received: by 2002:a17:902:e882:b0:1d7:600c:cc33 with SMTP id w2-20020a170902e88200b001d7600ccc33mr1403863plg.3.1705970177668; Mon, 22 Jan 2024 16:36:17 -0800 (PST) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id ky11-20020a170902f98b00b001d76ced199esm143464plb.31.2024.01.22.16.36.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Jan 2024 16:36:10 -0800 (PST) From: Kees Cook To: linux-hardening@vger.kernel.org Cc: Kees Cook , Andrew Morton , Uladzislau Rezki , Christoph Hellwig , Lorenzo Stoakes , linux-mm@kvack.org, "Gustavo A. R. Silva" , Bill Wendling , Justin Stitt , linux-kernel@vger.kernel.org Subject: [PATCH 33/82] mm/vmalloc: Refactor intentional wrap-around calculation Date: Mon, 22 Jan 2024 16:27:08 -0800 Message-Id: <20240123002814.1396804-33-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240122235208.work.748-kees@kernel.org> References: <20240122235208.work.748-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2352; i=keescook@chromium.org; h=from:subject; bh=38q5dA08W/MDhiiAfLHBMjgxLmUPPANEZSbZB460/eg=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBlrwgHVlKrqE6Nde4ZbwV5OP6txkBJRZom0feq8 p5yVXsvnAKJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZa8IBwAKCRCJcvTf3G3A JmDjD/45jgwtrPqGoB+jlF1mDgiUg9Ze61xsHyqXZi5GyOp0rRLZfu6w2qW/aeqxQOzjPHho3hN L2/snj7oP3CEPVZ0AsZx5pNEw4AdCtJLMAqBMw8/yxliXAWWX8mdo3JSCpQSuGT0wNY3HEJ6m3l 767XUkSfXo0VMs7+zd9DD+QTPMbV8GiSHrIfuaQMWoFDTr2PGGuOkEJfKLkVm8xcx68Q3gXonHh HOulIEvVuQ1wZ/971AY053i6TtPwkVQwttgTrT2I7qKM1rpF4801pZ6otFPevs/V20afhyDicxd MYf8bStbkOH8rXCaMRPbidxMQjMXvYBiFsbP+mWpuT0JkM6pBI2LDqDlh8wSwQZgl8lebVhoHsE XK0CCEBLvbN+lIUob2oN9JnImaQHOqI3vVnVdhxbYb1UfWeyb+9l7M52MDTY2cu+v7FIrIQxQaT Fp3QVNpjmkPKha2+jQyIAdAzfh6eFs21bZ92fq1gfnflXD1g5DYntbs9alZUEupfryc0jVwHArb 5cG743scfNC8Ph2+PXR6mQ/CI27ccqmUA2og/teJ1KqdKi31qS5E4P+XgGkowzLSabVuBBnq6t5 T8sabUmzoJL8AOtQMe0b06WPwGDOieCgh/OR6kZEHeys+Dj/7McgMk4ZPYPsu1HFh7LgL0n/nRL JTk2zIhWKJNoPYA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Rspamd-Queue-Id: C13371C000B X-Rspam-User: X-Rspamd-Server: rspam02 X-Stat-Signature: u37e833w13ifmppxjoa4e7gzt635p63f X-HE-Tag: 1705970178-258571 X-HE-Meta: U2FsdGVkX1/GC9MEZPVk8nlvaWJspxSBnqzQWm0X6S+9MOw7lcGPuzjcS/piGEM0jw3jfacbvjd9PHkGgDZ5s01XyH5tKjL/xd/RTufCMESC/tqKCX/D8dPMd5Whlyg66zeMcigeUoUKd7o2nOMuYQLQOzaLHUlZrRKoHIxtgYRHwn3gY/5yIOSFJVM7/KNCoUxIIRqQC1TRMQq2eC3jC+Ln35KRwR3hDJxfXcofNMlBcD2Q1P9IqhTZbg8z03eRop6zhqkCVwa9f5K5s5qBnb0ZSMlsrsIJx0Zm890DLT0NJzIBdQAvTP+6cl68BOQD9rwF7HM5QHz+cULvJ3Q+xJ5i1mCRnf5vEIBVEMD7swv+EYNBPsHdgzQhIiar5wZo7WisUu//+P2/XP8kTNFwarLbJuys50qAP0RhQ0MXua7z0mvJoZ8Tg4mPFgdU0K/uriAI0RDpvNpucV++IfR0SWi++dGSU4rn9LFKDUg6kzrp8tEnrTqV6AJwEqKnaPKCLV3EJzKqyNSNvrOEEztdSLgm1Yup1uBsNL02wusexCocS9Yphd6R79kROrhO+0uWps8yeepmAGKy5TyQ3bLHAJVtMTYMcQHMb/ezcLQBUzh4clYDnPlRNSx6G+OJfcI6iz4erWRZmOoplwEbl7FV2p/dz6u1ScQSaM+3LqIGaFNzPvcQ2zKw4+2Mtu6Ik3AjtxO/C9di0p9RXD3Cd+j4ZADQ4iduYhCgoG9uIx4W7in2fT+nJMdUnTJvQKlr59dxh0peZg4/tngQgYvDZuyFRI2KOCbjZ7rPQND4l8r5J5SVm5+s9UPWalQ5snFf5xB/PEgu2XH476THQ+ZB8mosFTr2z9yHYWFaQVk1mZ6bBtoIDTBRxtUHePY0kcDSYqOI98A0wCuUvhM3vclSAhgTfG0YRaCBCZlYRA5PHgw7rER6fzCvykGpvdatKAbU6KERciJKwTCe4oWqVPb2NFv +UELtefZ pEX8uy4wVbnoilhmCW6pqOUungRyzXTUnISIVccMJjDAcOPkUcZoUqZRgAPqhpnShDh4FV7BHdPKdcnWzyoS0l+57R4scw4q/qmnTlWfvrybw29/ubhLJe0iB27nncSqsU6YQv9zkvWLWo9/R+7be3dpC3IslKZWmGN8miuXUGHwQoj2gc2VijKVHhLZNzQ8h4zYnL6aisJcBQNx0tMrxkgVEDszqKDn+Nsd7kK3TDQ2rDw33bYUrqmlcD7kdD94zUlwPbT9ai/vbd1HuVcidQQUEQ7t19dqPbk/r7pU6FOQeBOWQgs5EmaD9sgud6tytbsmMMCtcAPKzMN2sl8rKPsIuDN7h7oq+tqa4D5u10imkvS/NygfNwPY/unZ0LAZhTdjz9vET/dDlu3RY44HCsEQuB1ddVnzoRqUgdDE/iXnGUQOkVNMSPvW80yjFe3MP5G3XNCfVAMzb8DTmFl2U/zd9ch99YDxUuCC6htL7XAAifToNgt58kXCHCndqVwdPlL1T5qnVl6nr6Qdw7kHfgs1Ea06rMfpBtO34yQxbJDbqMyTUjlbn/3uIOqHUO9Cc7vMUe2owNV18dZCreagGIRnK9BhSDDfvpzn6KPsyuaWoLnhH6Uqmg/PGYQxLfTKtfL1pjICo27J/PFQyO2IUbr5DQJXO2/uz8V6PvbDcrJul9TbbDhhYvYyZuw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: In an effort to separate intentional arithmetic wrap-around from unexpected wrap-around, we need to refactor places that depend on this kind of math. One of the most common code patterns of this is: VAR + value < VAR Notably, this is considered "undefined behavior" for signed and pointer types, which the kernel works around by using the -fno-strict-overflow option in the build[1] (which used to just be -fwrapv). Regardless, we want to get the kernel source to the position where we can meaningfully instrument arithmetic wrap-around conditions and catch them when they are unexpected, regardless of whether they are signed[2], unsigned[3], or pointer[4] types. Refactor open-coded unsigned wrap-around addition test to use check_add_overflow(), retaining the result for later usage (which removes the redundant open-coded addition). This paves the way to enabling the unsigned wrap-around sanitizer[2] in the future. Link: https://git.kernel.org/linus/68df3755e383e6fecf2354a67b08f92f18536594 [1] Link: https://github.com/KSPP/linux/issues/26 [2] Link: https://github.com/KSPP/linux/issues/27 [3] Link: https://github.com/KSPP/linux/issues/344 [4] Cc: Andrew Morton Cc: Uladzislau Rezki Cc: Christoph Hellwig Cc: Lorenzo Stoakes Cc: linux-mm@kvack.org Signed-off-by: Kees Cook Reviewed-by: Lorenzo Stoakes --- mm/vmalloc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index d12a17fc0c17..7932ac99e9d3 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -1223,6 +1223,7 @@ is_within_this_va(struct vmap_area *va, unsigned long size, unsigned long align, unsigned long vstart) { unsigned long nva_start_addr; + unsigned long sum; if (va->va_start > vstart) nva_start_addr = ALIGN(va->va_start, align); @@ -1230,11 +1231,11 @@ is_within_this_va(struct vmap_area *va, unsigned long size, nva_start_addr = ALIGN(vstart, align); /* Can be overflowed due to big size or alignment. */ - if (nva_start_addr + size < nva_start_addr || + if (check_add_overflow(nva_start_addr, size, &sum) || nva_start_addr < vstart) return false; - return (nva_start_addr + size <= va->va_end); + return (sum <= va->va_end); } /*