tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
fortify: Allow strlen() and strnlen() to pass compile-time known lengths
Under CONFIG_FORTIFY_SOURCE, it is possible for the compiler to perform
strlen() and strnlen() at compile-time when the string size is known.
This is required to support compile-time overflow checking in strlcpy().
Signed-off-by: Kees Cook <keescook@chromium.org>
+38
-11
+38
-11
include/linux/fortify-string.h
+38
-11
include/linux/fortify-string.h
···
10
10
void __read_overflow2(void) __compiletime_error("detected read beyond size of object (2nd parameter)");
11
11
void __write_overflow(void) __compiletime_error("detected write beyond size of object (1st parameter)");
12
12
13
+
#define __compiletime_strlen(p) \
14
+
({ \
15
+
unsigned char *__p = (unsigned char *)(p); \
16
+
size_t ret = (size_t)-1; \
17
+
size_t p_size = __builtin_object_size(p, 1); \
18
+
if (p_size != (size_t)-1) { \
19
+
size_t p_len = p_size - 1; \
20
+
if (__builtin_constant_p(__p[p_len]) && \
21
+
__p[p_len] == '\0') \
22
+
ret = __builtin_strlen(__p); \
23
+
} \
24
+
ret; \
25
+
})
26
+
13
27
#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
14
28
extern void *__underlying_memchr(const void *p, int c, __kernel_size_t size) __RENAME(memchr);
15
29
extern int __underlying_memcmp(const void *p, const void *q, __kernel_size_t size) __RENAME(memcmp);
···
74
60
__FORTIFY_INLINE __kernel_size_t strnlen(const char *p, __kernel_size_t maxlen)
75
61
{
76
62
size_t p_size = __builtin_object_size(p, 1);
77
-
__kernel_size_t ret = __real_strnlen(p, maxlen < p_size ? maxlen : p_size);
63
+
size_t p_len = __compiletime_strlen(p);
64
+
size_t ret;
78
65
66
+
/* We can take compile-time actions when maxlen is const. */
67
+
if (__builtin_constant_p(maxlen) && p_len != (size_t)-1) {
68
+
/* If p is const, we can use its compile-time-known len. */
69
+
if (maxlen >= p_size)
70
+
return p_len;
71
+
}
72
+
73
+
/* Do not check characters beyond the end of p. */
74
+
ret = __real_strnlen(p, maxlen < p_size ? maxlen : p_size);
79
75
if (p_size <= ret && maxlen != ret)
80
76
fortify_panic(__func__);
81
77
return ret;
82
78
}
83
79
80
+
/* defined after fortified strnlen to reuse it. */
84
81
__FORTIFY_INLINE __kernel_size_t strlen(const char *p)
85
82
{
86
83
__kernel_size_t ret;
87
84
size_t p_size = __builtin_object_size(p, 1);
88
85
89
-
/* Work around gcc excess stack consumption issue */
90
-
if (p_size == (size_t)-1 ||
91
-
(__builtin_constant_p(p[p_size - 1]) && p[p_size - 1] == '\0'))
86
+
/* Give up if we don't know how large p is. */
87
+
if (p_size == (size_t)-1)
92
88
return __underlying_strlen(p);
93
89
ret = strnlen(p, p_size);
94
90
if (p_size <= ret)
···
110
86
extern size_t __real_strlcpy(char *, const char *, size_t) __RENAME(strlcpy);
111
87
__FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size)
112
88
{
113
-
size_t ret;
114
89
size_t p_size = __builtin_object_size(p, 1);
115
90
size_t q_size = __builtin_object_size(q, 1);
91
+
size_t q_len; /* Full count of source string length. */
92
+
size_t len; /* Count of characters going into destination. */
116
93
117
94
if (p_size == (size_t)-1 && q_size == (size_t)-1)
118
95
return __real_strlcpy(p, q, size);
119
-
ret = strlen(q);
120
-
if (size) {
121
-
size_t len = (ret >= size) ? size - 1 : ret;
122
-
123
-
if (__builtin_constant_p(len) && len >= p_size)
96
+
q_len = strlen(q);
97
+
len = (q_len >= size) ? size - 1 : q_len;
98
+
if (__builtin_constant_p(size) && __builtin_constant_p(q_len) && size) {
99
+
/* Write size is always larger than destination. */
100
+
if (len >= p_size)
124
101
__write_overflow();
102
+
}
103
+
if (size) {
125
104
if (len >= p_size)
126
105
fortify_panic(__func__);
127
106
__underlying_memcpy(p, q, len);
128
107
p[len] = '\0';
129
108
}
130
-
return ret;
109
+
return q_len;
131
110
}
132
111
133
112
/* defined after fortified strnlen to reuse it */