Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 16 Sep 2022 17:55:55 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Kees Cook <keescook@chromium.org>
Cc:     "Gustavo A. R. Silva" <gustavoars@kernel.org>,
        Peter Rosin <peda@axentia.se>, Wolfram Sang <wsa@kernel.org>,
        "Gustavo A. R. Silva" <gustavo@embeddedor.com>,
        linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org,
        kernel-janitors@vger.kernel.org, linux-hardening@vger.kernel.org
Subject: Re: [PATCH] i2c: mux: harden i2c_mux_alloc() against integer
 overflows
Message-ID: <YySOewo2YUY+fk1l@kadam>
References: <YyMM8iVSHJ4ammsg@kili>
 <YyMt2cWtHC2SeG62@work>
 <YyMyKQnWgu0SL6jj@kadam>
 <202209160101.2A240E9@keescook>
 <YyQyfaI0WCsQ8F48@kadam>
 <202209160630.CF7AE9708D@keescook>
Content-Type: multipart/mixed; boundary="QZOuGIceusSsHqxQ"
Content-Disposition: inline
In-Reply-To: <202209160630.CF7AE9708D@keescook>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?QsBT4ufKNMLs/r/9zgyaj1NDGeLl1iQFIbx6BRdJuNVJ56WHUh8//KtFDj9h?=
 =?us-ascii?Q?yznaHqQ1OLHmoJkvNpKI1CvGLLSTt8jgXRYNhNzmcsLwpXmj7SsETzo6KOt8?=
 =?us-ascii?Q?J4mos49v/J1CPVlLHmUDorYeYHngZ4SsX3CXUFQVgosH2P5ANclQM/COhDNg?=
 =?us-ascii?Q?hOycLDGLuKdXjVz7hVQ+JJNVrTvLXSOoqlUBMiP6J2+9uXm/eJiqexJsTYnk?=
 =?us-ascii?Q?ehksuXlhWUzlUKfzh7XrZj7gqJlIDWA/Tiauqhk6ojFMvRUweCeSbMoD95ue?=
 =?us-ascii?Q?e98HykXLwO6JGl0Gc4Hp4lf8bg8Mnwhhe2Enc4AglLFYk+nj44IayuFKQ2Pf?=
 =?us-ascii?Q?NTDtXJB+PzvwBRe5o61hoWCm2/hby3fhZwkeX67K3CU6tYqim/EjSPYXr3dg?=
 =?us-ascii?Q?E/zM7ft7JJH0a7x+J18/1QQx7ez7/B197ZjU8onBZuWuAbPpoHrLbCz2g4qV?=
 =?us-ascii?Q?/LvOx2JW+O6ViglIVvl+NTPs+aZ715d9dzkUQ8yA4a1PFLjeGry4Z3bo42Km?=
 =?us-ascii?Q?lL8oVLthllmmVBBxfxcdM24kNrqjqU2d5bOpjDfq8f+ionfbloZHI+NR6qGP?=
 =?us-ascii?Q?q0jLvwmp5b8deJWoCHMT/sg1yHUBAL64vPGOaBHZrhTEP8feNdxZ/8Sq2vPH?=
 =?us-ascii?Q?yfI2Mh8NMTz7xFRBHOTY6MVEkZ2+AK+14hvtTbX3Ipn+RpuAWP4CVitAX8hS?=
 =?us-ascii?Q?qqmWaQGqxIRD9+quIa5MJLrV/2DuSmH4c+p9qUNX35vas/r8GsWiMi80NR9C?=
 =?us-ascii?Q?a45Sxz5PWmUGc71noQEkATNgM5qHzZFqGNs5XmvLhzDp969oVI8bwK3bk4oI?=
 =?us-ascii?Q?wWxHOH8HHb8uFBzbOd04NT64KxU64TJ0K8qowIEDqfzzBwLop58yMNEpnKlL?=
 =?us-ascii?Q?ou0XVSGURWmOfGadZfOotmfR2CPqAmRYbWc1gHLdsAEpg9kkGmp68/nivMZv?=
 =?us-ascii?Q?upQ1usYwmbjAP+I54+iNn+cTWGDWFHl+oGCHK4hyh5YZ2AjxTgyUb+hn2pk1?=
 =?us-ascii?Q?YwulQ/c+6ORXkVRHw2N3g9BGy28DcUYPyRoh4ZeDlrkpeqfMCtjCdUGom9Fb?=
 =?us-ascii?Q?smU8nOB9AoGbm1aOyGxFWzGGPI/MLTK6jEO78+tfRI1o/fZ0hFWxyobbWpqL?=
 =?us-ascii?Q?+zsomK8iNbNlgPh0qG41aVZH7zyMedfKoEqbFjUPl8J/PlhIzw9vSVDkDZWs?=
 =?us-ascii?Q?eJN4FemnwcDGuIBSpLraYYMfRb0qIvLmHTTFIycIKQuOiEenxetxXJ4sTbre?=
 =?us-ascii?Q?m9Gdo5TciipZ7ZnCCf5qkr3k3dvH+Eb4Ipz39Hb2x9fhSNVbP425xt7C7S2o?=
 =?us-ascii?Q?Xrj9+3dPLskH56t32EPtfCcZBgHf99whvaZoE9ydVDTipTaYAW6sgqOt4U4I?=
 =?us-ascii?Q?tKUj+A9j92PVnuJRFOWhfEK4RO5AiY5n0JD1HTpufVItPHTLb1GEsBmdKBl+?=
 =?us-ascii?Q?rRfTDJZWJkz5tOnitpvcQh2hS3uWE/2mJJGCNVziY1dXPvGdRtAvWnp1BeqS?=
 =?us-ascii?Q?uEUOoYyJmtwVCBjxCLRNHcNuU9I3iI9tmPfWtQebTQAoqUeK5NHG1PzSHtlH?=
 =?us-ascii?Q?UYmr0H8NDRosG6BuG9Qod/4A1yzjSVvpFkEOhy4Z/iEgyeVVqA/17FlOStTm?=
 =?us-ascii?Q?Ng=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 672d675b-57b7-44bc-420a-08da97f39883
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Sep 2022 14:56:12.1057
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: rYn8uYvjAHjx19HqHalrluBS5IySMHOML+7sr0Y7ifWXRs0/f1sY51OZ20+WiMrmi4RqukYyHQnBWWrYXA973hEN4dd6v2c+AZsMEaH4R8s=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5PR10MB6240
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1
 definitions=2022-09-16_09,2022-09-16_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 mlxlogscore=999 mlxscore=0
 adultscore=0 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000
 definitions=main-2209160110
X-Proofpoint-ORIG-GUID: EIjDpzYu4ud1kRWme9BRAnJV7hIfxCLr
X-Proofpoint-GUID: EIjDpzYu4ud1kRWme9BRAnJV7hIfxCLr
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

--QZOuGIceusSsHqxQ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Fri, Sep 16, 2022 at 06:31:45AM -0700, Kees Cook wrote:
> On Fri, Sep 16, 2022 at 11:23:25AM +0300, Dan Carpenter wrote:
> > [...]
> > net/ipv6/mcast.c:450 ip6_mc_source() saving 'size_add' to type 'int'
> 
> Interesting! Are you able to report the consumer? e.g. I think a bunch
> of these would be fixed by:
> 

Are you asking if I can add "passed to sock_kmalloc()" to the report?
It's possible but it's kind of a headache the way this code is written.

When you pass a function to another function in Smatch:

	frob(size_add());

Then Smatch creates a fake assignment:  "frob(fake_assign = size_add());"
and parses that instead.  So this check only looks at the
"fake_assign = size_add();"  assignment.

Attached.

regards,
dan carpenter


--QZOuGIceusSsHqxQ
Content-Type: text/x-csrc; charset=us-ascii
Content-Disposition: attachment; filename="check_overflow_truncated.c"

/*
 * Copyright (C) 2022 Oracle.
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
 */

#include "smatch.h"
#include "smatch_extra.h"
#include "smatch_slist.h"

static int my_id;

static void check_size_t(const char *fn, struct expression *expr, void *unused)
{
	struct symbol *type;

	type = get_type(expr->left);
	if (types_equiv(type, &long_ctype) ||
            types_equiv(type, &ulong_ctype))
		return;
	sm_msg("saving '%s' to type '%s'", fn, type_to_str(type));
}

void check_overflow_truncated(int id)
{
	my_id = id;

	if (option_project != PROJ_KERNEL)
		return;
	add_function_assign_hook("size_mul", &check_size_t, NULL);
	add_function_assign_hook("size_add", &check_size_t, NULL);
	add_function_assign_hook("size_sub", &check_size_t, NULL);
	add_function_assign_hook("__ab_c_size", &check_size_t, NULL);
	add_function_assign_hook("array_size", &check_size_t, NULL);
	add_function_assign_hook("array3_size", &check_size_t, NULL);

}

--QZOuGIceusSsHqxQ--