• Kees Cook's avatar
    ubsan: Reintroduce signed overflow sanitizer · 557f8c58
    Kees Cook authored
    In order to mitigate unexpected signed wrap-around[1], bring back the
    signed integer overflow sanitizer. It was removed in commit 6aaa31ae
    ("ubsan: remove overflow checks") because it was effectively a no-op
    when combined with -fno-strict-overflow (which correctly changes signed
    overflow from being "undefined" to being explicitly "wrap around").
    
    Compilers are adjusting their sanitizers to trap wrap-around and to
    detecting common code patterns that should not be instrumented
    (e.g. "var + offset < var"). Prepare for this and explicitly rename
    the option from "OVERFLOW" to "WRAP" to more accurately describe the
    behavior.
    
    To annotate intentional wrap-around arithmetic, the helpers
    wrapping_add/sub/mul_wrap() can be used for individual statements. At
    the function level, the __signed_wrap attribute can be used to mark an
    entire function as expecting its signed arithmetic to wrap around. For a
    single object file the Makefile can use "UBSAN_SIGNED_WRAP_target.o := n"
    to mark it as wrapping, and for an entire directory, "UBSAN_SIGNED_WRAP :=
    n" can be used.
    
    Additionally keep these disabled under CONFIG_COMPILE_TEST for now.
    
    Link: https://github.com/KSPP/linux/issues/26 [1]
    Cc: Miguel Ojeda <ojeda@kernel.org>
    Cc: Nathan Chancellor <nathan@kernel.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Hao Luo <haoluo@google.com>
    Reviewed-by: default avatarMarco Elver <elver@google.com>
    Reviewed-by: default avatarJustin Stitt <justinstitt@google.com>
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    557f8c58
ubsan.h 3.42 KB