diff options
| author |   Kees Cook <kees@kernel.org> | 2025-03-06 20:19:10 -0800 |
|---|---|---|
| committer | Kees Cook <kees@kernel.org> | 2025-03-07 19:58:05 -0800 |
| commit | 272a767063a6856cd1e18bb951d2be4f047b9858 (patch) | |
| tree | e99ada54422457cb1fa3bda50028254279f56706 | |
| parent | ubsan/overflow: Rework integer overflow sanitizer option to turn on everything (diff) | |
| download | wireguard-linux-272a767063a6856cd1e18bb951d2be4f047b9858.tar.xz wireguard-linux-272a767063a6856cd1e18bb951d2be4f047b9858.zip | |
ubsan/overflow: Enable pattern exclusions
To make integer wrap-around mitigation actually useful, the associated
sanitizers must not instrument cases where the wrap-around is explicitly
defined (e.g. "-2UL"), being tested for (e.g. "if (a + b < a)"), or
where it has no impact on code flow (e.g. "while (var--)"). Enable
pattern exclusions for the integer wrap sanitizers.
Reviewed-by: Justin Stitt <justinstitt@google.com>
Link: https://lore.kernel.org/r/20250307041914.937329-2-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
| -rw-r--r-- | lib/Kconfig.ubsan | 1 | ||||
| -rw-r--r-- | scripts/Makefile.ubsan | 1 |
2 files changed, 2 insertions, 0 deletions
diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan index 63e5622010e0..888c2e72c586 100644 --- a/lib/Kconfig.ubsan +++ b/lib/Kconfig.ubsan @@ -120,6 +120,7 @@ config UBSAN_INTEGER_WRAP bool "Perform checking for integer arithmetic wrap-around" default UBSAN depends on !COMPILE_TEST + depends on $(cc-option,-fsanitize-undefined-ignore-overflow-pattern=all) depends on $(cc-option,-fsanitize=signed-integer-overflow) depends on $(cc-option,-fsanitize=unsigned-integer-overflow) depends on $(cc-option,-fsanitize=implicit-signed-integer-truncation) diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan index 4fad9afed24c..233379c193a7 100644 --- a/scripts/Makefile.ubsan +++ b/scripts/Makefile.ubsan @@ -15,6 +15,7 @@ ubsan-cflags-$(CONFIG_UBSAN_TRAP) += $(call cc-option,-fsanitize-trap=undefined export CFLAGS_UBSAN := $(ubsan-cflags-y) ubsan-integer-wrap-cflags-$(CONFIG_UBSAN_INTEGER_WRAP) += \ + -fsanitize-undefined-ignore-overflow-pattern=all \ -fsanitize=signed-integer-overflow \ -fsanitize=unsigned-integer-overflow \ -fsanitize=implicit-signed-integer-truncation \ |