Message ID | 20230601151832.3632525-1-arnd@kernel.org (mailing list archive) |
---|---|
State | Not Applicable |
Headers |
Received: from vger.kernel.org ([23.128.96.18]) by www.linuxtv.org with esmtp (Exim 4.92) (envelope-from <linux-media-owner@vger.kernel.org>) id 1q4k5i-00DrK7-Nu; Thu, 01 Jun 2023 15:19:55 +0000 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233512AbjFAPTW (ORCPT <rfc822;mkrufky@linuxtv.org> + 1 other); Thu, 1 Jun 2023 11:19:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58016 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234915AbjFAPTD (ORCPT <rfc822;linux-media@vger.kernel.org>); Thu, 1 Jun 2023 11:19:03 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C626DB3; Thu, 1 Jun 2023 08:18:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5F85664675; Thu, 1 Jun 2023 15:18:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C525FC4339C; Thu, 1 Jun 2023 15:18:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1685632727; bh=zt7KZMmx/oJBYdfFdtNG8ZQh916ADU8eGaXVMVWxHLE=; h=From:To:Cc:Subject:Date:From; b=lOsYcDeZ6FDbxshIu7kdv+ump9fNlSvRpNRm6K6kLV3mxZKqoX7/SeZaOn5gv9gYd jUGbk6YWUoRlA6uXYqUPeKRY+B/G7Gtt6DRjGqb/rofNXy1cgD4lv6tend69ihuddC /Xs5cKYacjSj7o/Ch3PcbC+S5wqM/cwEt5cNvibv8wmRxcg74v43euAPEUPlY7fG5a I0xFlAuT7pGfRRlcmRdc3Ln/9JyPCzJ1R8eqd4eYbhqcuvyFxOQPjvsczQhU1vqyNd nWIyEt9HR0ur9SlpXBuqSzw77gRjWK2aT6fdvn0eK1AeOTk3eXPGF0sk7UpCqBMB8s Un4YXvEvE8kcg== From: Arnd Bergmann <arnd@kernel.org> To: kasan-dev@googlegroups.com, ryabinin.a.a@gmail.com Cc: glider@google.com, andreyknvl@gmail.com, dvyukov@google.com, vincenzo.frascino@arm.com, elver@google.com, linux-media@vger.kernel.org, linux-crypto@vger.kernel.org, herbert@gondor.apana.org.au, ardb@kernel.org, mchehab@kernel.org, Arnd Bergmann <arnd@arndb.de>, Dan Carpenter <dan.carpenter@linaro.org>, Matthias Brugger <matthias.bgg@gmail.com>, AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>, Nathan Chancellor <nathan@kernel.org>, Nick Desaulniers <ndesaulniers@google.com>, Tom Rix <trix@redhat.com>, Kees Cook <keescook@chromium.org>, Josh Poimboeuf <jpoimboe@kernel.org>, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, llvm@lists.linux.dev Subject: [PATCH] [RFC] ubsan: disallow bounds checking with gcov on broken gcc Date: Thu, 1 Jun 2023 17:18:11 +0200 Message-Id: <20230601151832.3632525-1-arnd@kernel.org> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-media.vger.kernel.org> X-Mailing-List: linux-media@vger.kernel.org X-LSpam-Score: -5.4 (-----) X-LSpam-Report: No, score=-5.4 required=5.0 tests=BAYES_00=-1.9,DKIMWL_WL_HIGH=0.001,DKIM_SIGNED=0.1,DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,DKIM_VALID_EF=-0.1,MAILING_LIST_MULTI=-1,RCVD_IN_DNSWL_MED=-2.3 autolearn=ham autolearn_force=no |
Series |
[RFC] ubsan: disallow bounds checking with gcov on broken gcc
|
|
Commit Message
Arnd Bergmann
June 1, 2023, 3:18 p.m. UTC
From: Arnd Bergmann <arnd@arndb.de> Combining UBSAN and GCOV in randconfig builds results in a number of stack frame size warnings, such as: crypto/twofish_common.c:683:1: error: the frame size of 2040 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c:1589:1: error: the frame size of 1696 bytes is larger than 1400 bytes [-Werror=frame-larger-than=] drivers/media/platform/verisilicon/hantro_g2_vp9_dec.c:754:1: error: the frame size of 1260 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] drivers/staging/media/ipu3/ipu3-css-params.c:1206:1: error: the frame size of 1080 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] drivers/staging/media/rkvdec/rkvdec-vp9.c:1042:1: error: the frame size of 2176 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] drivers/staging/media/rkvdec/rkvdec-vp9.c:995:1: error: the frame size of 1656 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] I managed to track this down to the -fsanitize=bounds option clashing with the -fprofile-arcs option, which leads a lot of spilled temporary variables in generated instrumentation code. Hopefully this can be addressed in future gcc releases the same way that clang handles the combination, but for existing compiler releases, it seems best to disable one of the two flags. This can be done either globally by just not passing both at the same time, or locally using the no_sanitize or no_instrument_function attributes in the affected functions. Try the simplest approach here, and turn off -fsanitize=bounds on gcc when GCOV is enabled, leaving the rest of UBSAN working. Doing this globally also helps avoid inefficient code from the same problem that did not push the build over the warning limit. Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/stable/6b1a0ee6-c78b-4873-bfd5-89798fce9899@kili.mountain/ Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110074 Link: https://godbolt.org/z/zvf7YqK5K Signed-off-by: Arnd Bergmann <arnd@arndb.de> --- lib/Kconfig.ubsan | 2 ++ 1 file changed, 2 insertions(+)
Comments
On Thu, Jun 01, 2023 at 05:18:11PM +0200, Arnd Bergmann wrote: > From: Arnd Bergmann <arnd@arndb.de> > > Combining UBSAN and GCOV in randconfig builds results in a number of > stack frame size warnings, such as: > > crypto/twofish_common.c:683:1: error: the frame size of 2040 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] > drivers/media/platform/mediatek/vcodec/vdec/vdec_vp9_req_lat_if.c:1589:1: error: the frame size of 1696 bytes is larger than 1400 bytes [-Werror=frame-larger-than=] > drivers/media/platform/verisilicon/hantro_g2_vp9_dec.c:754:1: error: the frame size of 1260 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] > drivers/staging/media/ipu3/ipu3-css-params.c:1206:1: error: the frame size of 1080 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] > drivers/staging/media/rkvdec/rkvdec-vp9.c:1042:1: error: the frame size of 2176 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] > drivers/staging/media/rkvdec/rkvdec-vp9.c:995:1: error: the frame size of 1656 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] > > I managed to track this down to the -fsanitize=bounds option clashing > with the -fprofile-arcs option, which leads a lot of spilled temporary > variables in generated instrumentation code. > > Hopefully this can be addressed in future gcc releases the same way > that clang handles the combination, but for existing compiler releases, > it seems best to disable one of the two flags. This can be done either > globally by just not passing both at the same time, or locally using > the no_sanitize or no_instrument_function attributes in the affected > functions. > > Try the simplest approach here, and turn off -fsanitize=bounds on > gcc when GCOV is enabled, leaving the rest of UBSAN working. Doing > this globally also helps avoid inefficient code from the same > problem that did not push the build over the warning limit. > > Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > Link: https://lore.kernel.org/stable/6b1a0ee6-c78b-4873-bfd5-89798fce9899@kili.mountain/ > Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110074 > Link: https://godbolt.org/z/zvf7YqK5K > Signed-off-by: Arnd Bergmann <arnd@arndb.de> I think more production systems will have CONFIG_UBSAN_BOUNDS enabled (e.g. Ubuntu has had it enabled for more than a year now) than GCOV, so I'd prefer we maintain all*config coverage for the more commonly used config. > --- > lib/Kconfig.ubsan | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan > index f7cbbad2bb2f4..8f71ff8f27576 100644 > --- a/lib/Kconfig.ubsan > +++ b/lib/Kconfig.ubsan > @@ -29,6 +29,8 @@ config UBSAN_TRAP > > config CC_HAS_UBSAN_BOUNDS_STRICT > def_bool $(cc-option,-fsanitize=bounds-strict) > + # work around https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110074 > + depends on GCC_VERSION > 140000 || !GCOV_PROFILE_ALL > help > The -fsanitize=bounds-strict option is only available on GCC, > but uses the more strict handling of arrays that includes knowledge Alternatively, how about falling back to -fsanitize=bounds instead, as that (which has less coverage) wasn't triggering the stack frame warnings? i.e. fall back through these: -fsanitize=array-bounds (Clang) -fsanitize=bounds-strict (!GCOV || bug fixed in GCC) -fsanitize=bounds
On Thu, Jun 1, 2023, at 18:14, Kees Cook wrote: > On Thu, Jun 01, 2023 at 05:18:11PM +0200, Arnd Bergmann wrote: > > I think more production systems will have CONFIG_UBSAN_BOUNDS enabled > (e.g. Ubuntu has had it enabled for more than a year now) than GCOV, > so I'd prefer we maintain all*config coverage for the more commonly > used config. Fair enough, I can send that as v2, but let's see what the others think first. >> config CC_HAS_UBSAN_BOUNDS_STRICT >> def_bool $(cc-option,-fsanitize=bounds-strict) >> + # work around https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110074 >> + depends on GCC_VERSION > 140000 || !GCOV_PROFILE_ALL >> help >> The -fsanitize=bounds-strict option is only available on GCC, >> but uses the more strict handling of arrays that includes knowledge > > Alternatively, how about falling back to -fsanitize=bounds instead, as > that (which has less coverage) wasn't triggering the stack frame > warnings? > > i.e. fall back through these: > -fsanitize=array-bounds (Clang) > -fsanitize=bounds-strict (!GCOV || bug fixed in GCC) > -fsanitize=bounds From what I can tell, -fsanitize=bounds has the same problem as -fsanitize=bounds-strict, so that would not help. Arnd
On Thu, Jun 01, 2023 at 07:50:38PM +0200, Arnd Bergmann wrote: > On Thu, Jun 1, 2023, at 18:14, Kees Cook wrote: > > On Thu, Jun 01, 2023 at 05:18:11PM +0200, Arnd Bergmann wrote: > > > > I think more production systems will have CONFIG_UBSAN_BOUNDS enabled > > (e.g. Ubuntu has had it enabled for more than a year now) than GCOV, > > so I'd prefer we maintain all*config coverage for the more commonly > > used config. > > Fair enough, I can send that as v2, but let's see what the others > think first. > > >> config CC_HAS_UBSAN_BOUNDS_STRICT > >> def_bool $(cc-option,-fsanitize=bounds-strict) > >> + # work around https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110074 > >> + depends on GCC_VERSION > 140000 || !GCOV_PROFILE_ALL > >> help > >> The -fsanitize=bounds-strict option is only available on GCC, > >> but uses the more strict handling of arrays that includes knowledge > > > > Alternatively, how about falling back to -fsanitize=bounds instead, as > > that (which has less coverage) wasn't triggering the stack frame > > warnings? > > > > i.e. fall back through these: > > -fsanitize=array-bounds (Clang) > > -fsanitize=bounds-strict (!GCOV || bug fixed in GCC) > > -fsanitize=bounds > > From what I can tell, -fsanitize=bounds has the same problem > as -fsanitize=bounds-strict, so that would not help. Ah, did something change with GCOV? This (bounds vs bounds-strict) is the only recent change to CONFIG_UBSAN_BOUNDS...
On Thu, Jun 1, 2023, at 20:28, Kees Cook wrote: > On Thu, Jun 01, 2023 at 07:50:38PM +0200, Arnd Bergmann wrote: >> On Thu, Jun 1, 2023, at 18:14, Kees Cook wrote: >> > >> > i.e. fall back through these: >> > -fsanitize=array-bounds (Clang) >> > -fsanitize=bounds-strict (!GCOV || bug fixed in GCC) >> > -fsanitize=bounds >> >> From what I can tell, -fsanitize=bounds has the same problem >> as -fsanitize=bounds-strict, so that would not help. > > Ah, did something change with GCOV? This (bounds vs bounds-strict) is > the only recent change to CONFIG_UBSAN_BOUNDS... I missed this problem in my usual randconfig builds because I was building with GCOV disabled due to disk size limitations until Dan Carpenter pointed out the specific issue. I suspect it's been there for a longer time. Arnd
diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan index f7cbbad2bb2f4..8f71ff8f27576 100644 --- a/lib/Kconfig.ubsan +++ b/lib/Kconfig.ubsan @@ -29,6 +29,8 @@ config UBSAN_TRAP config CC_HAS_UBSAN_BOUNDS_STRICT def_bool $(cc-option,-fsanitize=bounds-strict) + # work around https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110074 + depends on GCC_VERSION > 140000 || !GCOV_PROFILE_ALL help The -fsanitize=bounds-strict option is only available on GCC, but uses the more strict handling of arrays that includes knowledge