KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
83 stars 5 forks source link

constant string overflows lack compile-time warning since v5.11 #136

Closed kees closed 2 years ago

kees commented 3 years ago

Prior to v5.11, under CONFIG_FORTIFY_SOURCE=y a compile-time error will be generated. For example:

       char dst[8];
       ...
       strcpy(dst, "Crash point unregistered\n"); /* line 21 noted below */

produces:

...
                 from drivers/misc/lkdtm/core.c:21:
In function 'memcpy',
    inlined from 'lkdtm_module_exit' at ./include/linux/fortify-string.h:281:2:
./include/linux/fortify-string.h:185:4: error: call to '__write_overflow' declared with attribute error: detected write beyond size of object passed as 1st parameter
  185 |    __write_overflow();
      |    ^~~~~~~~~~~~~~~~~~

v5.11 and later seem to have a bug here when strscpy() coverage was added. The runtime check is correct, but the compile time error has gone missing. This needs fixing.

Originally posted by @kees in https://github.com/KSPP/linux/issues/88#issuecomment-890550730

kees commented 3 years ago

Specifically, 6a39e62abbafd1d58d1722f40c7d26ef379c6a2f broke the compile-time warnings for strcpy(), and the strscpy() check from 33e56a59e64dfb68778e5da0be13f0c47dc5d445 suffers from the same problem.

kees commented 2 years ago

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/include/linux/fortify-string.h?id=072af0c638dc8a5c7db2edc4dddbd6d44bee3bdb