Commit 08d45ee8 authored by Kees Cook's avatar Kees Cook
Browse files

overflow: Introduce wrapping_assign_add() and wrapping_assign_sub() 



This allows replacements of the idioms "var += offset" and "var -=
offset" with the wrapping_assign_add() and wrapping_assign_sub() helpers
respectively. They will avoid wrap-around sanitizer instrumentation.

Add to the selftests to validate behavior and lack of side-effects.

Reviewed-by: default avatarMarco Elver <elver@google.com>
Acked-by: default avatarMark Rutland <mark.rutland@arm.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent d70de805

include/linux/overflow.h

+32 −0
Original line number Diff line number Diff line
@@ -81,6 +81,22 @@ static inline bool __must_check __must_check_overflow(bool overflow) 
		__val;						\

	})



/**

 * wrapping_assign_add() - Intentionally perform a wrapping increment assignment

 * @var: variable to be incremented

 * @offset: amount to add

 *

 * Increments @var by @offset with wrap-around. Returns the resulting

 * value of @var. Will not trip any wrap-around sanitizers.

 *

 * Returns the new value of @var.

 */

#define wrapping_assign_add(var, offset)				\

	({								\

		typeof(var) *__ptr = &(var);				\

		*__ptr = wrapping_add(typeof(var), *__ptr, offset);	\

	})



/**

 * check_sub_overflow() - Calculate subtraction with overflow checking

 * @a: minuend; value to subtract from
@@ -111,6 +127,22 @@ static inline bool __must_check __must_check_overflow(bool overflow) 
		__val;						\

	})



/**

 * wrapping_assign_sub() - Intentionally perform a wrapping decrement assign

 * @var: variable to be decremented

 * @offset: amount to subtract

 *

 * Decrements @var by @offset with wrap-around. Returns the resulting

 * value of @var. Will not trip any wrap-around sanitizers.

 *

 * Returns the new value of @var.

 */

#define wrapping_assign_sub(var, offset)				\

	({								\

		typeof(var) *__ptr = &(var);				\

		*__ptr = wrapping_sub(typeof(var), *__ptr, offset);	\

	})



/**

 * check_mul_overflow() - Calculate multiplication with overflow checking

 * @a: first factor

lib/overflow_kunit.c

+43 −0
Original line number Diff line number Diff line
@@ -284,6 +284,45 @@ DEFINE_TEST_ARRAY(s64) = { 
		"Unexpected wrap " #op " macro side-effect!\n");	\

} while (0)



static int global_counter;

static void bump_counter(void)

{

	global_counter++;

}



static int get_index(void)

{

	volatile int index = 0;

	bump_counter();

	return index;

}



#define check_self_op(fmt, op, sym, a, b) do {				\

	typeof(a + 0) _a = a;						\

	typeof(b + 0) _b = b;						\

	typeof(a + 0) _a_sym = a;					\

	typeof(a + 0) _a_orig[1] = { a };				\

	typeof(b + 0) _b_orig = b;					\

	typeof(b + 0) _b_bump = b + 1;					\

	typeof(a + 0) _r;						\

									\

	_a_sym sym _b;							\

	_r = wrapping_ ## op(_a, _b);					\

	KUNIT_EXPECT_TRUE_MSG(test, _r == _a_sym,			\

		"expected "fmt" "#op" "fmt" == "fmt", got "fmt"\n",	\

		a, b, _a_sym, _r);					\

	KUNIT_EXPECT_TRUE_MSG(test, _a == _a_sym,			\

		"expected "fmt" "#op" "fmt" == "fmt", got "fmt"\n",	\

		a, b, _a_sym, _a);					\

	/* Check for internal macro side-effects. */			\

	global_counter = 0;						\

	wrapping_ ## op(_a_orig[get_index()], _b_orig++);		\

	KUNIT_EXPECT_EQ_MSG(test, global_counter, 1,			\

		"Unexpected wrapping_" #op " macro side-effect on arg1!\n"); \

	KUNIT_EXPECT_EQ_MSG(test, _b_orig, _b_bump,			\

		"Unexpected wrapping_" #op " macro side-effect on arg2!\n"); \

} while (0)



#define DEFINE_TEST_FUNC_TYPED(n, t, fmt)				\

static void do_test_ ## n(struct kunit *test, const struct test_ ## n *p) \

{									\
@@ -293,6 +332,10 @@ static void do_test_ ## n(struct kunit *test, const struct test_ ## n *p) \ 
	check_one_op(t, fmt, sub, "-", p->a, p->b, p->diff, p->d_of);	\

	check_one_op(t, fmt, mul, "*", p->a, p->b, p->prod, p->p_of);	\

	check_one_op(t, fmt, mul, "*", p->b, p->a, p->prod, p->p_of);	\

	/* wrapping_assign_{add,sub}() */				\

	check_self_op(fmt, assign_add, +=, p->a, p->b);			\

	check_self_op(fmt, assign_add, +=, p->b, p->a);			\

	check_self_op(fmt, assign_sub, -=, p->a, p->b);			\

}									\

									\

static void n ## _overflow_test(struct kunit *test) {			\