ubsan: integer-overflow: depend on BROKEN to keep this out of CI

[PATCH] ubsan: integer-overflow: depend on BROKEN to keep this out of CI

Posted by Kees Cook 8 months, 2 weeks ago

Depending on !COMPILE_TEST isn't sufficient to keep this feature out of
CI because we can't stop it from being included in randconfig builds.
This feature is still highly experimental, and is developed in lock-step
with Clang's Overflow Behavior Types[1]. Depend on BROKEN to keep it
from being enabled by anyone not expecting it.

Link: https://discourse.llvm.org/t/rfc-v2-clang-introduce-overflowbehaviortypes-for-wrapping-and-non-wrapping-arithmetic/86507 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: Justin Stitt <justinstitt@google.com>
Cc: Eric Biggers <ebiggers@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Jann Horn <jannh@google.com>
Cc: Marco Elver <elver@google.com>
Cc: llvm@lists.linux.dev
Cc: <linux-hardening@vger.kernel.org>
---
 lib/Kconfig.ubsan | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
index f6ea0c5b5da3..96cd89668467 100644
--- a/lib/Kconfig.ubsan
+++ b/lib/Kconfig.ubsan
@@ -118,6 +118,8 @@ config UBSAN_UNREACHABLE
 
 config UBSAN_INTEGER_WRAP
 	bool "Perform checking for integer arithmetic wrap-around"
+	# This is very experimental so drop the next line if you really want it
+	depends on BROKEN
 	depends on !COMPILE_TEST
 	depends on $(cc-option,-fsanitize-undefined-ignore-overflow-pattern=all)
 	depends on $(cc-option,-fsanitize=signed-integer-overflow)
-- 
2.34.1

Re: [PATCH] ubsan: integer-overflow: depend on BROKEN to keep this out of CI

Posted by Marco Elver 8 months, 2 weeks ago

On Wed, 28 May 2025 at 20:26, Kees Cook <kees@kernel.org> wrote:
>
> Depending on !COMPILE_TEST isn't sufficient to keep this feature out of
> CI because we can't stop it from being included in randconfig builds.
> This feature is still highly experimental, and is developed in lock-step
> with Clang's Overflow Behavior Types[1]. Depend on BROKEN to keep it
> from being enabled by anyone not expecting it.
>
> Link: https://discourse.llvm.org/t/rfc-v2-clang-introduce-overflowbehaviortypes-for-wrapping-and-non-wrapping-arithmetic/86507 [1]
> Signed-off-by: Kees Cook <kees@kernel.org>

Acked-by: Marco Elver <elver@google.com>

> ---
> Cc: Justin Stitt <justinstitt@google.com>
> Cc: Eric Biggers <ebiggers@kernel.org>
> Cc: Arnd Bergmann <arnd@arndb.de>
> Cc: Jann Horn <jannh@google.com>
> Cc: Marco Elver <elver@google.com>
> Cc: llvm@lists.linux.dev
> Cc: <linux-hardening@vger.kernel.org>
> ---
>  lib/Kconfig.ubsan | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
> index f6ea0c5b5da3..96cd89668467 100644
> --- a/lib/Kconfig.ubsan
> +++ b/lib/Kconfig.ubsan
> @@ -118,6 +118,8 @@ config UBSAN_UNREACHABLE
>
>  config UBSAN_INTEGER_WRAP
>         bool "Perform checking for integer arithmetic wrap-around"
> +       # This is very experimental so drop the next line if you really want it
> +       depends on BROKEN
>         depends on !COMPILE_TEST
>         depends on $(cc-option,-fsanitize-undefined-ignore-overflow-pattern=all)
>         depends on $(cc-option,-fsanitize=signed-integer-overflow)
> --
> 2.34.1
>

Re: [PATCH] ubsan: integer-overflow: depend on BROKEN to keep this out of CI

Posted by Nathan Chancellor 8 months, 2 weeks ago

On Wed, May 28, 2025 at 11:26:22AM -0700, Kees Cook wrote:
> Depending on !COMPILE_TEST isn't sufficient to keep this feature out of
> CI because we can't stop it from being included in randconfig builds.
> This feature is still highly experimental, and is developed in lock-step
> with Clang's Overflow Behavior Types[1]. Depend on BROKEN to keep it
> from being enabled by anyone not expecting it.
> 
> Link: https://discourse.llvm.org/t/rfc-v2-clang-introduce-overflowbehaviortypes-for-wrapping-and-non-wrapping-arithmetic/86507 [1]
> Signed-off-by: Kees Cook <kees@kernel.org>

Should this have a 'Cc: stable@vger.kernel.org' on it? There might not
be much randconfig testing on stable but it is still very much possible
for some random user to turn this on and report problems.

Regardless of that though, I think this is a good idea with how much of
this feature is still being ironed out.

Reviewed-by: Nathan Chancellor <nathan@kernel.org>

Once this lands, I plan to mark all issues in the CBL issue tracker that
came about from UBSAN_INTEGER_WRAP as 'have a workaround applied' since
it will not be possible for regular users to hit them but you may
consider notating them in case they need to be addressed before the
feature can be reenabled.

> ---
> Cc: Justin Stitt <justinstitt@google.com>
> Cc: Eric Biggers <ebiggers@kernel.org>
> Cc: Arnd Bergmann <arnd@arndb.de>
> Cc: Jann Horn <jannh@google.com>
> Cc: Marco Elver <elver@google.com>
> Cc: llvm@lists.linux.dev
> Cc: <linux-hardening@vger.kernel.org>
> ---
>  lib/Kconfig.ubsan | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
> index f6ea0c5b5da3..96cd89668467 100644
> --- a/lib/Kconfig.ubsan
> +++ b/lib/Kconfig.ubsan
> @@ -118,6 +118,8 @@ config UBSAN_UNREACHABLE
>  
>  config UBSAN_INTEGER_WRAP
>  	bool "Perform checking for integer arithmetic wrap-around"
> +	# This is very experimental so drop the next line if you really want it
> +	depends on BROKEN
>  	depends on !COMPILE_TEST
>  	depends on $(cc-option,-fsanitize-undefined-ignore-overflow-pattern=all)
>  	depends on $(cc-option,-fsanitize=signed-integer-overflow)
> -- 
> 2.34.1
> 
>

Re: [PATCH] ubsan: integer-overflow: depend on BROKEN to keep this out of CI

Posted by Kees Cook 8 months, 2 weeks ago

On Wed, May 28, 2025 at 02:32:23PM -0700, Nathan Chancellor wrote:
> On Wed, May 28, 2025 at 11:26:22AM -0700, Kees Cook wrote:
> > Depending on !COMPILE_TEST isn't sufficient to keep this feature out of
> > CI because we can't stop it from being included in randconfig builds.
> > This feature is still highly experimental, and is developed in lock-step
> > with Clang's Overflow Behavior Types[1]. Depend on BROKEN to keep it
> > from being enabled by anyone not expecting it.
> > 
> > Link: https://discourse.llvm.org/t/rfc-v2-clang-introduce-overflowbehaviortypes-for-wrapping-and-non-wrapping-arithmetic/86507 [1]
> > Signed-off-by: Kees Cook <kees@kernel.org>
> 
> Should this have a 'Cc: stable@vger.kernel.org' on it? There might not
> be much randconfig testing on stable but it is still very much possible
> for some random user to turn this on and report problems.

Ah yeah, I should probably do this via a proper Fixes: tag. I'll add
this.

> Regardless of that though, I think this is a good idea with how much of
> this feature is still being ironed out.
> 
> Reviewed-by: Nathan Chancellor <nathan@kernel.org>

Thanks!

> 
> Once this lands, I plan to mark all issues in the CBL issue tracker that
> came about from UBSAN_INTEGER_WRAP as 'have a workaround applied' since
> it will not be possible for regular users to hit them but you may
> consider notating them in case they need to be addressed before the
> feature can be reenabled.

Sounds good!

-Kees

-- 
Kees Cook

Re: [PATCH] ubsan: integer-overflow: depend on BROKEN to keep this out of CI

Posted by Greg KH 8 months, 2 weeks ago

On Wed, May 28, 2025 at 04:00:03PM -0700, Kees Cook wrote:
> On Wed, May 28, 2025 at 02:32:23PM -0700, Nathan Chancellor wrote:
> > On Wed, May 28, 2025 at 11:26:22AM -0700, Kees Cook wrote:
> > > Depending on !COMPILE_TEST isn't sufficient to keep this feature out of
> > > CI because we can't stop it from being included in randconfig builds.
> > > This feature is still highly experimental, and is developed in lock-step
> > > with Clang's Overflow Behavior Types[1]. Depend on BROKEN to keep it
> > > from being enabled by anyone not expecting it.
> > > 
> > > Link: https://discourse.llvm.org/t/rfc-v2-clang-introduce-overflowbehaviortypes-for-wrapping-and-non-wrapping-arithmetic/86507 [1]
> > > Signed-off-by: Kees Cook <kees@kernel.org>
> > 
> > Should this have a 'Cc: stable@vger.kernel.org' on it? There might not
> > be much randconfig testing on stable but it is still very much possible
> > for some random user to turn this on and report problems.
> 
> Ah yeah, I should probably do this via a proper Fixes: tag. I'll add
> this.

Nit, "Fixes:" tags alone without a cc: stable do not guarantee they will
end up in the stable trees.  Always explicitly add a cc: please.

thanks,

greg k-h

Re: [PATCH] ubsan: integer-overflow: depend on BROKEN to keep this out of CI

Posted by Eric Biggers 8 months, 2 weeks ago

On Wed, May 28, 2025 at 11:26:22AM -0700, Kees Cook wrote:
> Depending on !COMPILE_TEST isn't sufficient to keep this feature out of
> CI because we can't stop it from being included in randconfig builds.
> This feature is still highly experimental, and is developed in lock-step
> with Clang's Overflow Behavior Types[1]. Depend on BROKEN to keep it
> from being enabled by anyone not expecting it.
> 
> Link: https://discourse.llvm.org/t/rfc-v2-clang-introduce-overflowbehaviortypes-for-wrapping-and-non-wrapping-arithmetic/86507 [1]
> Signed-off-by: Kees Cook <kees@kernel.org>
> ---
> Cc: Justin Stitt <justinstitt@google.com>
> Cc: Eric Biggers <ebiggers@kernel.org>
> Cc: Arnd Bergmann <arnd@arndb.de>
> Cc: Jann Horn <jannh@google.com>
> Cc: Marco Elver <elver@google.com>
> Cc: llvm@lists.linux.dev
> Cc: <linux-hardening@vger.kernel.org>
> ---
>  lib/Kconfig.ubsan | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
> index f6ea0c5b5da3..96cd89668467 100644
> --- a/lib/Kconfig.ubsan
> +++ b/lib/Kconfig.ubsan
> @@ -118,6 +118,8 @@ config UBSAN_UNREACHABLE
>  
>  config UBSAN_INTEGER_WRAP
>  	bool "Perform checking for integer arithmetic wrap-around"
> +	# This is very experimental so drop the next line if you really want it
> +	depends on BROKEN
>  	depends on !COMPILE_TEST
>  	depends on $(cc-option,-fsanitize-undefined-ignore-overflow-pattern=all)
>  	depends on $(cc-option,-fsanitize=signed-integer-overflow)
> -- 

Acked-by: Eric Biggers <ebiggers@kernel.org>

- Eric