Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <06a907d2-e976-ed8a-bfff-277c835d9ab2@intel.com>
Date:   Mon, 26 Sep 2022 18:57:53 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.12.0
Subject: Re: [PATCH v11.5] overflow: Introduce overflows_type() and
 __castable_to_type()
Content-Language: en-US
To:     Kees Cook <keescook@chromium.org>
CC:     Luc Van Oostenryck <luc.vanoostenryck@gmail.com>,
        Nathan Chancellor <nathan@kernel.org>,
        Nick Desaulniers <ndesaulniers@google.com>,
        Tom Rix <trix@redhat.com>,
        Daniel Latypov <dlatypov@google.com>,
        Vitor Massaru Iha <vitor@massaru.org>,
        "Gustavo A. R. Silva" <gustavoars@kernel.org>,
        <linux-hardening@vger.kernel.org>, <llvm@lists.linux.dev>,
        <intel-gfx@lists.freedesktop.org>, <linux-kernel@vger.kernel.org>,
        <dri-devel@lists.freedesktop.org>, <mchehab@kernel.org>,
        <chris@chris-wilson.co.uk>, <matthew.auld@intel.com>,
        <thomas.hellstrom@linux.intel.com>, <jani.nikula@intel.com>,
        <nirmoy.das@intel.com>, <airlied@redhat.com>, <daniel@ffwll.ch>,
        <andi.shyti@linux.intel.com>, <andrzej.hajda@intel.com>,
        <mauro.chehab@linux.intel.com>, <linux@rasmusvillemoes.dk>,
        <linux-sparse@vger.kernel.org>
References: <20220926003743.409911-1-keescook@chromium.org>
From:   Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
In-Reply-To: <20220926003743.409911-1-keescook@chromium.org>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?L3NTYlV5RmQxUk4zeVN2OU1xdFVZcjlrU1FJOUppeGM4b1ZlNCtCRXVPQkNY?=
 =?utf-8?B?bEd3VG5lRzE0U2V6TnlTNFlXcFJVZndCU0tDVUpySHpsVHQ0WjhFdUU5bWRv?=
 =?utf-8?B?VWpMakl4WGd0M28yWnArOWVtVU9CdSs1VE8zSlZscU5nUGtmQ0tPNjlZOFJH?=
 =?utf-8?B?Tjl6UW9kekFjcVh6ZmRKbittZnhRWTFuSE1OWE9Sd1NwdERyUU56dkdTdzgv?=
 =?utf-8?B?aS90enVEK29tOW1ySURYTGl1NmFpeHdKZzBOOG8zb1JqVWZmYnN5emZNQjVq?=
 =?utf-8?B?UUNJczlJckN0aGpvemZMbmw1Ny9OSFB4bzFyUFk4THlNVHZUelRhaHZoSHJa?=
 =?utf-8?B?ZGhidVVMWm5xR05QMmg2aW1ZNnNrZTJZM0pWQVZNWU1vL3JpVi9ENjJlQmd0?=
 =?utf-8?B?L2dRZGxpRGUyaitqRENIVGZ0bkFKa0JYZ24wZ1JPTVRQaWJ5bm8xejFnM3lj?=
 =?utf-8?B?N2lKWGpZdEhSN0R1aVFEK01jdGZ3Q3k4VWNnRUE0U1dYMjY3anpOQUdjUFJK?=
 =?utf-8?B?RzJtYXl2Q01KN2ZXWkV1TzNRNUExTlhzZWFHUjcyNW00Q2FoUFI2enNTdGwv?=
 =?utf-8?B?V2p2aWtNSU5sVVlMUUFUMkxadW1aRnVhS1dtTm0zZmhRaUR5UHViSUxiYUZZ?=
 =?utf-8?B?Z3ZpVTV5Y1ZTbVVEeWVYTU8wb2pEeVRDaHI5N212c3JQdENxeFBYUzRJT2lp?=
 =?utf-8?B?TG9FM3RRYjdCM1JBTmtPS1lnbUlaOFVQU3JGRlk5bnZSSTJlWUdlVWNib05n?=
 =?utf-8?B?TnAzaWJBWGZ2eFBNMFE1R2VzUDJtaDFTb2JhMWp4cWtYcHJGZkF4d1FCTjdz?=
 =?utf-8?B?RzNjek5ySlFvT3RlZXQ0TGplc3NvYk4yVlFwZHZrSDhzL0JEdWMzOXBUcjFn?=
 =?utf-8?B?dFpnZ2JyaitxbWNQMk1nQXdWMHVBQktPNXQzMjE1bjNtZmMxdWRINjNFME1s?=
 =?utf-8?B?MFdXc1lBcVMwcC9VVFdxZkk4Rko0SDJmd2ZoL1UyRVZDb0lCMzN4TG9MdmZS?=
 =?utf-8?B?UVU4dmhSOWFQR2lJNUFvZ1RVZVlmMHovN25pNUxJV1B3aU1kanBLSVQ2Umpm?=
 =?utf-8?B?ZDViMzNNVUlCMEUyR0l2eGZMTTFzcjNLeDdjNDZ3NUJ2aHRvNi9sSG5jRjZw?=
 =?utf-8?B?ckZoMXVKc3QxWXh3UVd6VGV4anNLVTNGYTdMaHNKbzMwcjVrcENyalVuaGlV?=
 =?utf-8?B?b0hzZ3JLSnFkVVlYdGdiY2FQaWpUbXpGWFhXVzZPcnFScDM4SHRiS2c5TXBI?=
 =?utf-8?B?Tzg0Z29zaWNiWVdzR20xT0RhS1lPaUJLcTVJMG55aW5JMEVhL1pJUnhxQ3FB?=
 =?utf-8?B?RkNVL1ZkMUdBYTFkVlY4WjlSM3h2c0VHUml0YVhLZmo1V01RMnlkb0hrbUZ3?=
 =?utf-8?B?UVc5SGdpNlNhbUhlbExSRUdOdHowSkVRYmNxQTBLaTc3aElBeG5Gbk13eWJa?=
 =?utf-8?B?Rk1PSkZoakVKRklNSk1Lc3Nad2pkb1p4clVDL0MxVEtkbTlwREtsWThYTlJE?=
 =?utf-8?B?ZjhUOEJJbWtDWDk5VzFzMWVrNkZoWWhKbFl5eWMvUE54VjhSZnpNc0tOM21X?=
 =?utf-8?B?aFh6cXNyMHpsbmZmZkhaS0dvQll1c3A5UEgyQWJ0enkxeXdiVzlLRVdYaVRs?=
 =?utf-8?B?S1M0Q0o5czloSGxZVlNpeFdUYTlNTG0wZWJtRHhTWDZFeGdIRVdwY0RRNk5i?=
 =?utf-8?B?ZzA1TWlRVUNjN3pFTVh5RVlJanZqSUkwZzBSTzJPZ1dEazc1T1RZQklQUjU0?=
 =?utf-8?B?NG90c3lSRjZLSzVkQ215cVhKTXg5TVlxN29TOVI4aHBFQ094bWZ5dmlpMFRD?=
 =?utf-8?B?SVRoaUZBWG1QSU1zQkl5bkJSK2RJT3dPSUdQcU1ZcEExQ1RySndaUkxrbU90?=
 =?utf-8?B?UVRuNlZZSzZrUHBDNHZZZkFCbEtudTZVamE1c2pJd1ZxdDhUcGFOYWhLb053?=
 =?utf-8?B?Qis4aG9MUGpTbDYxTlVFNmpncUMxSWR5dzRvRUM1MGNQUkJPZnRFNCtYS3Z4?=
 =?utf-8?B?K3pCZGtDVTdBNENTMVc0L3J0YXpWeUlXNkpTMXp6YWgyUTdEQ0xuVzRJVGRz?=
 =?utf-8?B?emQzM3VYVWliODNieTR0RHFjTmVRUWJSdFREYk10Qi9hc1lEU0pLWFlDaVpo?=
 =?utf-8?B?ckVBQ3EyNFBTZ1lDRnlQZEVCKzc2QTRLQzF3dXVtWGNTTm91Skw0anB0bFYv?=
 =?utf-8?B?S2c9PQ==?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 264057b1-37e5-4b7d-2ae3-08da9fd7f32d
X-MS-Exchange-CrossTenant-AuthSource: CH0PR11MB5409.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Sep 2022 15:58:27.7798
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Rp57YfzHbe3ryPKEFb9n22squkwmwmpOzOm5g+XTJLzBIjIOBlBWUqmhX1EP30G0dKDDkcNdTISEx/7XroCustvBfPe+BFpnIWPfrgUIrAI=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR11MB5342
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,
        RCVD_IN_DNSWL_MED,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 9/26/22 3:37 AM, Kees Cook wrote:
> Add overflows_type() to test if a variable or constant value would
> overflow another variable or type. This can be used as a constant
> expression for static_assert() (which requires a constant
> expression[1][2]) when used on constant values. This must be constructed
> manually, since __builtin_add_overflow() does not produce a constant
> expression[3].
> 
> Additionally adds __castable_to_type(), similar to __same_type(), for
> checking if a constant value will fit in a given type (i.e. it could
> be cast to the type without overflow).
> 
> Add unit tests for overflows_type(), __same_type(), and
> __castable_to_type() to the existing KUnit "overflow" test.
> 
> [1] https://en.cppreference.com/w/c/language/_Static_assert
> [2] C11 standard (ISO/IEC 9899:2011): 6.7.10 Static assertions
> [3] https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html
>      6.56 Built-in Functions to Perform Arithmetic with Overflow Checking
>      Built-in Function: bool __builtin_add_overflow (type1 a, type2 b,
>                                                      type3 *res)
> 
> Cc: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
> Cc: Nathan Chancellor <nathan@kernel.org>
> Cc: Nick Desaulniers <ndesaulniers@google.com>
> Cc: Tom Rix <trix@redhat.com>
> Cc: Daniel Latypov <dlatypov@google.com>
> Cc: Vitor Massaru Iha <vitor@massaru.org>
> Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
> Cc: linux-hardening@vger.kernel.org
> Cc: llvm@lists.linux.dev
> Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
>   include/linux/compiler.h |   1 +
>   include/linux/overflow.h |  48 +++++
>   lib/overflow_kunit.c     | 393 ++++++++++++++++++++++++++++++++++++++-
>   3 files changed, 441 insertions(+), 1 deletion(-)
> 
> diff --git a/include/linux/compiler.h b/include/linux/compiler.h
> index 7713d7bcdaea..c631107e93b1 100644
> --- a/include/linux/compiler.h
> +++ b/include/linux/compiler.h
> @@ -244,6 +244,7 @@ static inline void *offset_to_ptr(const int *off)
>    * bool and also pointer types.
>    */
>   #define is_signed_type(type) (((type)(-1)) < (__force type)1)
> +#define is_unsigned_type(type) (!is_signed_type(type))
>   
>   /*
>    * This is needed in functions which generate the stack canary, see
> diff --git a/include/linux/overflow.h b/include/linux/overflow.h
> index 19dfdd74835e..c8cbeae5f4f8 100644
> --- a/include/linux/overflow.h
> +++ b/include/linux/overflow.h
> @@ -127,6 +127,54 @@ static inline bool __must_check __must_check_overflow(bool overflow)
>   	(*_d >> _to_shift) != _a);					\
>   }))
>   
> +#define __overflows_type_constexpr(x, T) (			\
> +	is_unsigned_type(typeof(x)) ?				\
> +		(x) > type_max(typeof(T)) ? 1 : 0		\
> +	: is_unsigned_type(typeof(T)) ?				\
> +		(x) < 0 || (x) > type_max(typeof(T)) ? 1 : 0	\
> +		: (x) < type_min(typeof(T)) ||			\
> +		  (x) > type_max(typeof(T)) ? 1 : 0 )
> +
> +#define __overflows_type(x, T)		({	\
> +	typeof(T) v = 0;			\
> +	check_add_overflow((x), v, &v);		\
> +})
> +
> +/**
> + * overflows_type - helper for checking the overflows between value, variables,
> + *		    or data type
> + *
> + * @n: source constant value or variable to be checked
> + * @T: destination variable or data type proposed to store @x
> + *
> + * Compares the @x expression for whether or not it can safely fit in
> + * the storage of the type in @T. @x and @T can have different types.
> + * If @x is a conxtant expression, this will also resolve to a constant
> + * expression.
> + *
> + * Returns: true if overflow can occur, false otherwise.
> + */
> +#define overflows_type(n, T)					\
> +	__builtin_choose_expr(__is_constexpr(n),		\
> +			      __overflows_type_constexpr(n, T),	\
> +			      __overflows_type(n, T))
> +
> +/**
> + * __castable_to_type - like __same_type(), but also allows for casted literals
> + *
> + * @n: variable or constant value
> + * @T: data type or variable
> + *
> + * Unlike the __same_type() macro, this allows a constant value as the
> + * first argument. If this value would not overflow into an assignment
> + * of the second argument's type, it returns true. Otherwise, this falls
> + * back to __same_type().
> + */
> +#define __castable_to_type(n, T)					\
> +	__builtin_choose_expr(__is_constexpr(n),			\
> +			      !__overflows_type_constexpr(n, T),	\
> +			      __same_type(n, T))
> +
This name is fine, but I prefer the __same_typable you suggested as a 
comment in the previous patch better, what do you think?
( __castable_to_type(n, T); The macro name seems to handle if type 
casting is possible to the second argument type from the first argument 
variable. )

G.G.