On Mon, May 19, 2025 at 12:15:30PM -0700, Kees Cook wrote:

On Mon, May 19, 2025 at 08:41:17PM +0200, Mickaël Salaün wrote:

quoted

On Mon, May 19, 2025 at 11:19:53AM -0700, Kees Cook wrote:

quoted

On Mon, May 19, 2025 at 05:29:30PM +0200, Mickaël Salaün wrote:

quoted

On Fri, May 16, 2025 at 07:54:14PM -0700, Randy Dunlap wrote:

quoted

On 5/16/25 3:24 AM, Stephen Rothwell wrote:

quoted

Hi all,

Changes since 20250515:

Thanks for the report.

It is the same warning as reported here:
https://lore.kernel.org/all/202501040747.S3LYfvYq-lkp@intel.com/ (local)

I don't know what the actual issue is though.

quoted

on i386:

In file included from ../arch/x86/include/asm/string.h:3,
                 from ../include/linux/string.h:65,
                 from ../include/linux/bitmap.h:13,
                 from ../include/linux/cpumask.h:12,
                 from ../include/linux/smp.h:13,
                 from ../include/linux/lockdep.h:14,
                 from ../security/landlock/ruleset.c:16:
../security/landlock/ruleset.c: In function 'create_rule':
../arch/x86/include/asm/string_32.h:150:25: warning: '__builtin_memcpy' accessing 4294967295 bytes at offsets 20 and 0 overlaps 6442450943 bytes at offset -2147483648 [-Wrestrict]
  150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~
../security/landlock/ruleset.c:137:9: note: in expansion of macro 'memcpy'
  137 |         memcpy(new_rule->layers, layers,
      |         ^~~~~~


Full randconfig file is attached.

The trigger appears to be CONFIG_PROFILE_ALL_BRANCHES, and GCC getting
tricked into thinking check_mul_overflow() returns true:

In file included from ../arch/x86/include/asm/string.h:3,
                 from ../include/linux/string.h:65,
                 from ../include/linux/bitmap.h:13,
                 from ../include/linux/cpumask.h:12,
                 from ../include/linux/smp.h:13,
                 from ../include/linux/lockdep.h:14,
                 from ../security/landlock/ruleset.c:16:
../security/landlock/ruleset.c: In function 'create_rule':
../arch/x86/include/asm/string_32.h:150:25: warning: '__builtin_memcpy' accessing 4294967295 bytes at offsets 0 and 0 overlaps 6442450943 bytes at offset -2147483648 [-Wrestrict]
  150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~
../security/landlock/ruleset.c:137:9: note: in expansion of macro 'memcpy'
  137 |         memcpy(new_rule->layers, layers,
      |         ^~~~~~
  'create_rule': event 1
../include/linux/compiler.h:69:46:
   68 |         (cond) ?                                        \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   69 |                 (__if_trace.miss_hit[1]++,1) :          \
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~
      |                                              |
      |                                              (1) when the condition is evaluated to true
   70 |                 (__if_trace.miss_hit[0]++,0);           \
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
../include/linux/compiler.h:57:69: note: in expansion of macro '__trace_if_value'
   57 | #define __trace_if_var(cond) (__builtin_constant_p(cond) ? (cond) : __trace_if_value(cond))
      |                                                                     ^~~~~~~~~~~~~~~~
../include/linux/compiler.h:55:28: note: in expansion of macro '__trace_if_var'
   55 | #define if(cond, ...) if ( __trace_if_var( !!(cond , ## __VA_ARGS__) ) )
      |                            ^~~~~~~~~~~~~~
../include/linux/overflow.h:270:9: note: in expansion of macro 'if'
  270 |         if (check_mul_overflow(factor1, factor2, &bytes))
      |         ^~
  'create_rule': event 2
../arch/x86/include/asm/string_32.h:150:25:
  150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~
      |                         |
      |                         (2) out of array bounds here
../security/landlock/ruleset.c:137:9: note: in expansion of macro 'memcpy'
  137 |         memcpy(new_rule->layers, layers,
      |         ^~~~~~
make[1]: Leaving directory '/srv/code/gcc-bug'

That's interesting...

quoted

I'll take a look at ways to make either the overflow macros or memcpy
robust against this kind of weirdness...

Thanks!

I'm doing some build testing, but the below patch makes GCC happy.
Alternatively we could make CONFIG_PROFILE_ALL_BRANCHES=y depend on
CONFIG_FORTIFY_SOURCE=y ...


From 6fbf66fdfd0a7dac809b77faafdd72c60112bb8d Mon Sep 17 00:00:00 2001
From: Kees Cook <kees@kernel.org>
Date: Mon, 19 May 2025 11:52:06 -0700
Subject: [PATCH] string.h: Provide basic sanity checks for fallback memcpy()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of defining memcpy() in terms of __builtin_memcpy() deep
in arch/x86/include/asm/string_32.h, notice that it is needed up in
the general string.h, as done with other common C String APIs. This
allows us to add basic sanity checking for pathological "size"
arguments to memcpy(). Besides the run-time checking benefit, this
avoids GCC trying to be very smart about value range tracking[1] when
CONFIG_PROFILE_ALL_BRANCHES=y but FORTIFY_SOURCE=n.

It works for me but I couldn't reproduce the issue.  I tried with
CONFIG_PROFILE_ALL_BRANCHES=y and CONFIG_FORTIFY_SOURCE=n but it always
works without a warning.  I'm using GCC 15.  Is it specific to a version
of GCC?