nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

string: Check for "nonstring" attribute on strscpy() arguments

Browse source 
GCC already checks for arguments that are marked with the "nonstring"[1]
attribute when used on standard C String API functions (e.g. strcpy). Gain
this compile-time checking also for the kernel's primary string copying
function, strscpy().

Note that Clang has neither "nonstring" nor __builtin_has_attribute().

Link: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-nonstring-variable-attribute [1]
Reviewed-by: Miguel Ojeda <ojeda@kernel.org>
Tested-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://lore.kernel.org/r/20240805214340.work.339-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
This commit is contained in:
Kees Cook 2024-08-05 14:43:44 -07:00
parent 32ef4b710c
commit 559048d156
3 changed files with 18 additions and 4 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

3
include/linux/compiler.h
View file

@ -242,6 +242,9 @@ static inline void *offset_to_ptr(const int *off)
/* &a[0] degrades to a pointer: a different type from an array */ /* &a[0] degrades to a pointer: a different type from an array */
#define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0])) #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
/* Require C Strings (i.e. NUL-terminated) lack the "nonstring" attribute. */
#define __must_be_cstr(p) BUILD_BUG_ON_ZERO(__annotated(p, nonstring))
/* /*
* This returns a constant expression while determining if an argument is * This returns a constant expression while determining if an argument is
* a constant expression, most importantly without evaluating the argument. * a constant expression, most importantly without evaluating the argument.

7
include/linux/compiler_types.h
View file

@ -421,6 +421,13 @@ struct ftrace_likely_data {
#define __member_size(p) __builtin_object_size(p, 1) #define __member_size(p) __builtin_object_size(p, 1)
#endif #endif
/* Determine if an attribute has been applied to a variable. */
#if __has_builtin(__builtin_has_attribute)
#define __annotated(var, attr) __builtin_has_attribute(var, attr)
#else
#define __annotated(var, attr) (false)
#endif
/* /*
* Some versions of gcc do not mark 'asm goto' volatile: * Some versions of gcc do not mark 'asm goto' volatile:
* *

12
include/linux/string.h
View file

@ -76,12 +76,16 @@ ssize_t sized_strscpy(char *, const char *, size_t);
* known size. * known size.
*/ */
#define __strscpy0(dst, src, ...) \ #define __strscpy0(dst, src, ...) \
sized_strscpy(dst, src, sizeof(dst) + __must_be_array(dst)) sized_strscpy(dst, src, sizeof(dst) + __must_be_array(dst) + \
#define __strscpy1(dst, src, size) sized_strscpy(dst, src, size) __must_be_cstr(dst) + __must_be_cstr(src))
#define __strscpy1(dst, src, size) \
sized_strscpy(dst, src, size + __must_be_cstr(dst) + __must_be_cstr(src))
#define __strscpy_pad0(dst, src, ...) \ #define __strscpy_pad0(dst, src, ...) \
sized_strscpy_pad(dst, src, sizeof(dst) + __must_be_array(dst)) sized_strscpy_pad(dst, src, sizeof(dst) + __must_be_array(dst) + \
#define __strscpy_pad1(dst, src, size) sized_strscpy_pad(dst, src, size) __must_be_cstr(dst) + __must_be_cstr(src))
#define __strscpy_pad1(dst, src, size) \
sized_strscpy_pad(dst, src, size + __must_be_cstr(dst) + __must_be_cstr(src))
/** /**
* strscpy - Copy a C-string into a sized buffer * strscpy - Copy a C-string into a sized buffer