From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC65CC7EE29 for ; Wed, 31 May 2023 22:37:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230419AbjEaWh3 (ORCPT ); Wed, 31 May 2023 18:37:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49896 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230267AbjEaWh2 (ORCPT ); Wed, 31 May 2023 18:37:28 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6108E9F; Wed, 31 May 2023 15:37:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EB7EA62B7A; Wed, 31 May 2023 22:37:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 67BCAC433D2; Wed, 31 May 2023 22:37:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1685572646; bh=EjcnHeLPSFskAfrECWzs0sBFgzC+oBoE4wsOMlpomy0=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=edK7cDRjdx4uas4edYdeXU/b0jIuH8g7/WAZNO5DSDCcS0YaLilbgVUxIipuqn5Sp lCrLS+s9ffLTuvceyREmandUiBzww2Vm0FYVd7oH4zVCgA7VgWyC4/aQm8/ZjNTSUf b8dbYVPA/tpNUEHbYxINyxen0NE2uVgFjLwJopgxn2aGeJWfo+BwbqMuk5GklRaie4 BgZ3XO7jaS1yOCF3xtfHmqCN16wqOGz3/Y6/nx8TG/JM4IQehwiYUwDsrRH1KQ19w1 kYhSF0XubTIbUD/FtSIs0J51Ts29QRj156kFbUdfPrTl9s1jRsrnK2pZBGThy4VlGW BHubXoEh2en9g== Date: Wed, 31 May 2023 23:37:20 +0100 From: Conor Dooley To: Kees Cook Cc: Paul Walmsley , Thorsten Leemhuis , Joan Bruguera =?iso-8859-1?Q?Mic=F3?= , Palmer Dabbelt , Albert Ou , Masahiro Yamada , Conor Dooley , Nick Desaulniers , Alyssa Ross , Heiko Stuebner , "Gustavo A. R. Silva" , linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: Re: [PATCH] riscv/purgatory: Do not use fortified string functions Message-ID: <20230531-abruptly-settling-f9852f408dcd@spud> References: <20230531003404.never.167-kees@kernel.org> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="ZFT5h/br0IBkD5vu" Content-Disposition: inline In-Reply-To: <20230531003404.never.167-kees@kernel.org> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --ZFT5h/br0IBkD5vu Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hey Kees, On Tue, May 30, 2023 at 05:34:04PM -0700, Kees Cook wrote: > With the addition of -fstrict-flex-arrays=3D3, struct sha256_state's > trailing array is no longer ignored by CONFIG_FORTIFY_SOURCE: >=20 > struct sha256_state { > u32 state[SHA256_DIGEST_SIZE / 4]; > u64 count; > u8 buf[SHA256_BLOCK_SIZE]; > }; >=20 > This means that the memcpy() calls with "buf" as a destination in > sha256.c's code will attempt to perform run-time bounds checking, which > could lead to calling missing functions, specifically a potential > WARN_ONCE, which isn't callable from purgatory. >=20 > Reported-by: Thorsten Leemhuis > Closes: https://lore.kernel.org/lkml/175578ec-9dec-7a9c-8d3a-43f24ff86b92= @leemhuis.info/ > Bisected-by: "Joan Bruguera Mic=F3" > Fixes: df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3D3") > Cc: Paul Walmsley > Cc: Palmer Dabbelt > Cc: Albert Ou > Cc: Masahiro Yamada > Cc: Conor Dooley > Cc: Nick Desaulniers > Cc: Alyssa Ross > Cc: Heiko Stuebner > Cc: "Gustavo A. R. Silva" > Cc: linux-riscv@lists.infradead.org > Signed-off-by: Kees Cook Perhaps this is indicative of other issues in RISC-V land, but allmodconfig complains about this patch: =2E./lib/string.c:17: warning: "__NO_FORTIFY" redefined =2E./lib/string.c:17:9: warning: preprocessor token __NO_FORTIFY redefined > --- > arch/riscv/purgatory/Makefile | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) >=20 > diff --git a/arch/riscv/purgatory/Makefile b/arch/riscv/purgatory/Makefile > index 5730797a6b40..11f4c275f141 100644 > --- a/arch/riscv/purgatory/Makefile > +++ b/arch/riscv/purgatory/Makefile > @@ -31,9 +31,9 @@ $(obj)/strncmp.o: $(srctree)/arch/riscv/lib/strncmp.S F= ORCE > $(obj)/sha256.o: $(srctree)/lib/crypto/sha256.c FORCE > $(call if_changed_rule,cc_o_c) > =20 > -CFLAGS_sha256.o :=3D -D__DISABLE_EXPORTS > -CFLAGS_string.o :=3D -D__DISABLE_EXPORTS > -CFLAGS_ctype.o :=3D -D__DISABLE_EXPORTS > +CFLAGS_sha256.o :=3D -D__DISABLE_EXPORTS -D__NO_FORTIFY > +CFLAGS_string.o :=3D -D__DISABLE_EXPORTS -D__NO_FORTIFY > +CFLAGS_ctype.o :=3D -D__DISABLE_EXPORTS -D__NO_FORTIFY > =20 > # When linking purgatory.ro with -r unresolved symbols are not checked, > # also link a purgatory.chk binary without -r to check for unresolved sy= mbols. > --=20 > 2.34.1 >=20 >=20 > _______________________________________________ > linux-riscv mailing list > linux-riscv@lists.infradead.org > http://lists.infradead.org/mailman/listinfo/linux-riscv --ZFT5h/br0IBkD5vu Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQRh246EGq/8RLhDjO14tDGHoIJi0gUCZHfMIAAKCRB4tDGHoIJi 0skGAP0RP0L15KqUDxAa/Z7n2whLtyvwOJmOwsbDDBUC+eTiWAD/cULCWm/j6GXO GcD+DaRrgW5urSzwpXiAq1ng8PzMFwg= =q9r1 -----END PGP SIGNATURE----- --ZFT5h/br0IBkD5vu--