• Daniel Axtens's avatar
    kasan: stop tests being eliminated as dead code with FORTIFY_SOURCE · adb72ae1
    Daniel Axtens authored
    Patch series "Fix some incompatibilites between KASAN and FORTIFY_SOURCE", v4.
    
    3 KASAN self-tests fail on a kernel with both KASAN and FORTIFY_SOURCE:
    memchr, memcmp and strlen.
    
    When FORTIFY_SOURCE is on, a number of functions are replaced with
    fortified versions, which attempt to check the sizes of the operands.
    However, these functions often directly invoke __builtin_foo() once they
    have performed the fortify check.  The compiler can detect that the
    results of these functions are not used, and knows that they have no other
    side effects, and so can eliminate them as dead code.
    
    Why are only memchr, memcmp and strlen affected?
    ================================================
    
    Of string and string-like functions, kasan_test tests:
    
     * strchr  ->  not affected, no fortified version
     * strrchr ->  likewise
     * strcmp  ->  likewise
     * strncmp ->  likewise
    
     * strnlen ->  not affected, the fortify source implementation calls the
                   underlying strnlen implementation which is instrumented, not
                   a builtin
    
     * strlen  ->  affected, the fortify souce implementation calls a __builtin
                   version which the compiler can determine is dead.
    
     * memchr  ->  likewise
     * memcmp  ->  likewise
    
     * memset ->   not affected, the compiler knows that memset writes to its
    	       first argument and therefore is not dead.
    
    Why does this not affect the functions normally?
    ================================================
    
    In string.h, these functions are not marked as __pure, so the compiler
    cannot know that they do not have side effects.  If relevant functions are
    marked as __pure in string.h, we see the following warnings and the
    functions are elided:
    
    lib/test_kasan.c: In function `kasan_memchr':
    lib/test_kasan.c:606:2: warning: statement with no effect [-Wunused-value]
      memchr(ptr, '1', size + 1);
      ^~~~~~~~~~~~~~~~~~~~~~~~~~
    lib/test_kasan.c: In function `kasan_memcmp':
    lib/test_kasan.c:622:2: warning: statement with no effect [-Wunused-value]
      memcmp(ptr, arr, size+1);
      ^~~~~~~~~~~~~~~~~~~~~~~~
    lib/test_kasan.c: In function `kasan_strings':
    lib/test_kasan.c:645:2: warning: statement with no effect [-Wunused-value]
      strchr(ptr, '1');
      ^~~~~~~~~~~~~~~~
    ...
    
    This annotation would make sense to add and could be added at any point,
    so the behaviour of test_kasan.c should change.
    
    The fix
    =======
    
    Make all the functions that are pure write their results to a global,
    which makes them live.  The strlen and memchr tests now pass.
    
    The memcmp test still fails to trigger, which is addressed in the next
    patch.
    
    [dja@axtens.net: drop patch 3]
      Link: http://lkml.kernel.org/r/20200424145521.8203-2-dja@axtens.net
    Fixes: 0c96350a ("lib/test_kasan.c: add tests for several string/memory API functions")
    Signed-off-by: default avatarDaniel Axtens <dja@axtens.net>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Tested-by: default avatarDavid Gow <davidgow@google.com>
    Reviewed-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Cc: Daniel Micay <danielmicay@gmail.com>
    Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
    Cc: Alexander Potapenko <glider@google.com>
    Link: http://lkml.kernel.org/r/20200423154503.5103-1-dja@axtens.net
    Link: http://lkml.kernel.org/r/20200423154503.5103-2-dja@axtens.netSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    adb72ae1
test_kasan.c 17.6 KB