mbox series

[v6,0/2] _FORTIFY_SOURCE=3

Message ID 20201219063314.1409576-1-siddhesh@sourceware.org
Headers show
Series _FORTIFY_SOURCE=3 | expand

Message

Siddhesh Poyarekar Dec. 19, 2020, 6:33 a.m. UTC 
This patchset implements a new fortification level, _FORTIFY_SOURCE=3.
This level allows size information to be dynamic, which may potentially
have a noticeable performance impact.  It uses the
__builtin_dynamic_object_size builtin available in clang to expand
coverage of fortifications at the expense of some performance.

Patch 1/2 implements the base support and support for functions that
have builtins of string functions.  Additionally, the patch also
describes the use case and tradeoffs.

Patch 2/2 adds support for non-string functions that are
fortification-ready for levels 1 and 2.

Testing:

The glibc testsuite doesn't directly support clang at the moment, so
having tests in the glibc source tree is pointless as long as gcc does
not have support for __builtin_dynamic_object_size.  There is a separate
project on GitHub called fortify-test-suite[1] that houses fortification
tests and is capable of testing multiple levels of fortification with
multiple compilers.  I have proposed a PR[2] to add support for
_FORTIFY_SOURCE=3 and have verified my changes with those tests.

Those tests run clean for clang when run with these changes and PR[2]
and they fail at level 3 for gcc, as expected.

[1] https://github.com/serge-sans-paille/fortify-test-suite
[2] https://github.com/serge-sans-paille/fortify-test-suite/pull/9

Changes from previous series:

- Adopted Paul Eggert's macro soup because it has better texture while
  retaining the flavour.

Siddhesh Poyarekar (2):
  string: _FORTIFY_SOURCE=3 using __builtin_dynamic_object_size
  nonstring: _FORTIFY_SOURCE=3 using __builtin_dynamic_object_size

 NEWS                            |   6 ++
 include/features.h              |   8 ++
 include/string.h                |   5 +-
 io/bits/poll2.h                 |  16 ++--
 libio/bits/stdio.h              |   2 +-
 libio/bits/stdio2.h             |  53 ++++++-------
 manual/creature.texi            |   3 +-
 misc/sys/cdefs.h                |   9 +++
 posix/bits/unistd.h             | 112 ++++++++++++++-------------
 socket/bits/socket2.h           |  18 ++---
 stdlib/bits/stdlib.h            |  37 ++++-----
 string/bits/string_fortified.h  |  22 +++---
 string/bits/strings_fortified.h |   4 +-
 wcsmbs/bits/wchar2.h            | 131 ++++++++++++++++----------------
 14 files changed, 230 insertions(+), 196 deletions(-)

Comments

Siddhesh Poyarekar Dec. 22, 2020, 1 p.m. UTC | #1 
On 12/19/20 12:03 PM, Siddhesh Poyarekar via Libc-alpha wrote:
> This patchset implements a new fortification level, _FORTIFY_SOURCE=3.
> This level allows size information to be dynamic, which may potentially
> have a noticeable performance impact.  It uses the
> __builtin_dynamic_object_size builtin available in clang to expand
> coverage of fortifications at the expense of some performance.
> 
> Patch 1/2 implements the base support and support for functions that
> have builtins of string functions.  Additionally, the patch also
> describes the use case and tradeoffs.
> 
> Patch 2/2 adds support for non-string functions that are
> fortification-ready for levels 1 and 2.

Any more comments on this?  I believe I have fixed all the outstanding 
issues that were pointed out during previous reviews.

Siddhesh
Adhemerval Zanella Netto Dec. 22, 2020, 9:49 p.m. UTC | #2 
On 22/12/2020 10:00, Siddhesh Poyarekar wrote:
> On 12/19/20 12:03 PM, Siddhesh Poyarekar via Libc-alpha wrote:
>> This patchset implements a new fortification level, _FORTIFY_SOURCE=3.
>> This level allows size information to be dynamic, which may potentially
>> have a noticeable performance impact.  It uses the
>> __builtin_dynamic_object_size builtin available in clang to expand
>> coverage of fortifications at the expense of some performance.
>>
>> Patch 1/2 implements the base support and support for functions that
>> have builtins of string functions.  Additionally, the patch also
>> describes the use case and tradeoffs.
>>
>> Patch 2/2 adds support for non-string functions that are
>> fortification-ready for levels 1 and 2.
> 
> Any more comments on this?  I believe I have fixed all the outstanding issues that were pointed out during previous reviews.
> 
> Siddhesh

I will check this out tomorrow, but it seems ok skimming through it.