Commit 559048d1 authored by Kees Cook's avatar Kees Cook
Browse files

string: Check for "nonstring" attribute on strscpy() arguments 

GCC already checks for arguments that are marked with the "nonstring"[1]
attribute when used on standard C String API functions (e.g. strcpy). Gain
this compile-time checking also for the kernel's primary string copying
function, strscpy().

Note that Clang has neither "nonstring" nor __builtin_has_attribute().

Link: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-nonstring-variable-attribute

 [1]
Reviewed-by: default avatarMiguel Ojeda <ojeda@kernel.org>
Tested-by: default avatarMiguel Ojeda <ojeda@kernel.org>
Link: https://lore.kernel.org/r/20240805214340.work.339-kees@kernel.org


Signed-off-by: default avatarKees Cook <kees@kernel.org>
parent 32ef4b71

include/linux/compiler.h

+3 −0
Original line number Diff line number Diff line
@@ -242,6 +242,9 @@ static inline void *offset_to_ptr(const int *off) 
/* &a[0] degrades to a pointer: a different type from an array */

#define __must_be_array(a)	BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))



/* Require C Strings (i.e. NUL-terminated) lack the "nonstring" attribute. */

#define __must_be_cstr(p)	BUILD_BUG_ON_ZERO(__annotated(p, nonstring))



/*

 * This returns a constant expression while determining if an argument is

 * a constant expression, most importantly without evaluating the argument.

include/linux/compiler_types.h

+7 −0
Original line number Diff line number Diff line
@@ -421,6 +421,13 @@ struct ftrace_likely_data { 
#define __member_size(p)	__builtin_object_size(p, 1)

#endif



/* Determine if an attribute has been applied to a variable. */

#if __has_builtin(__builtin_has_attribute)

#define __annotated(var, attr)	__builtin_has_attribute(var, attr)

#else

#define __annotated(var, attr)	(false)

#endif



/*

 * Some versions of gcc do not mark 'asm goto' volatile:

 *

include/linux/string.h

+8 −4
Original line number Diff line number Diff line
@@ -76,12 +76,16 @@ ssize_t sized_strscpy(char *, const char *, size_t); 
 * known size.

 */

#define __strscpy0(dst, src, ...)	\

	sized_strscpy(dst, src, sizeof(dst) + __must_be_array(dst))

#define __strscpy1(dst, src, size)	sized_strscpy(dst, src, size)

	sized_strscpy(dst, src, sizeof(dst) + __must_be_array(dst) +	\

				__must_be_cstr(dst) + __must_be_cstr(src))

#define __strscpy1(dst, src, size)	\

	sized_strscpy(dst, src, size + __must_be_cstr(dst) + __must_be_cstr(src))



#define __strscpy_pad0(dst, src, ...)	\

	sized_strscpy_pad(dst, src, sizeof(dst) + __must_be_array(dst))

#define __strscpy_pad1(dst, src, size)	sized_strscpy_pad(dst, src, size)

	sized_strscpy_pad(dst, src, sizeof(dst) + __must_be_array(dst) +	\

				    __must_be_cstr(dst) + __must_be_cstr(src))

#define __strscpy_pad1(dst, src, size)	\

	sized_strscpy_pad(dst, src, size + __must_be_cstr(dst) + __must_be_cstr(src))



/**

 * strscpy - Copy a C-string into a sized buffer