• Josh Poimboeuf's avatar
    mm/usercopy: get rid of CONFIG_DEBUG_STRICT_USER_COPY_CHECKS · 0d025d27
    Josh Poimboeuf authored
    There are three usercopy warnings which are currently being silenced for
    gcc 4.6 and newer:
    
    1) "copy_from_user() buffer size is too small" compile warning/error
    
       This is a static warning which happens when object size and copy size
       are both const, and copy size > object size.  I didn't see any false
       positives for this one.  So the function warning attribute seems to
       be working fine here.
    
       Note this scenario is always a bug and so I think it should be
       changed to *always* be an error, regardless of
       CONFIG_DEBUG_STRICT_USER_COPY_CHECKS.
    
    2) "copy_from_user() buffer size is not provably correct" compile warning
    
       This is another static warning which happens when I enable
       __compiletime_object_size() for new compilers (and
       CONFIG_DEBUG_STRICT_USER_COPY_CHECKS).  It happens when object size
       is const, but copy size is *not*.  In this case there's no way to
       compare the two at build time, so it gives the warning.  (Note the
       warning is a byproduct of the fact that gcc has no way of knowing
       whether the overflow function will be called, so the call isn't dead
       code and the warning attribute is activated.)
    
       So this warning seems to only indicate "this is an unusual pattern,
       maybe you should check it out" rather than "this is a bug".
    
       I get 102(!) of these warnings with allyesconfig and the
       __compiletime_object_size() gcc check removed.  I don't know if there
       are any real bugs hiding in there, but from looking at a small
       sample, I didn't see any.  According to Kees, it does sometimes find
       real bugs.  But the false positive rate seems high.
    
    3) "Buffer overflow detected" runtime warning
    
       This is a runtime warning where object size is const, and copy size >
       object size.
    
    All three warnings (both static and runtime) were completely disabled
    for gcc 4.6 with the following commit:
    
      2fb0815c ("gcc4: disable __compiletime_object_size for GCC 4.6+")
    
    That commit mistakenly assumed that the false positives were caused by a
    gcc bug in __compiletime_object_size().  But in fact,
    __compiletime_object_size() seems to be working fine.  The false
    positives were instead triggered by #2 above.  (Though I don't have an
    explanation for why the warnings supposedly only started showing up in
    gcc 4.6.)
    
    So remove warning #2 to get rid of all the false positives, and re-enable
    warnings #1 and #3 by reverting the above commit.
    
    Furthermore, since #1 is a real bug which is detected at compile time,
    upgrade it to always be an error.
    
    Having done all that, CONFIG_DEBUG_STRICT_USER_COPY_CHECKS is no longer
    needed.
    Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: "H . Peter Anvin" <hpa@zytor.com>
    Cc: Andy Lutomirski <luto@amacapital.net>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: Byungchul Park <byungchul.park@lge.com>
    Cc: Nilay Vaish <nilayvaish@gmail.com>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    0d025d27
uaccess.h 17.4 KB