On Fri, Jun 26, 2015 at 2:19 AM, Geert Uytterhoeven <geert@xxxxxxxxxxxxxx> wrote: > On Tue, Jun 9, 2015 at 12:55 AM, Kees Cook <keescook@xxxxxxxxxxxx> wrote: >>> commit 95420c349194d1b570270ba1b1567d85461761c3 >>> Author: Kees Cook <keescook@xxxxxxxxxxxx> >>> AuthorDate: Mon Sep 16 11:15:54 2013 -0700 >>> Commit: Kees Cook <keescook@xxxxxxxxxxxx> >>> CommitDate: Wed Mar 4 14:07:18 2015 -0800 >>> >>> Make all format string problems fail the build >>> >>> In an effort to stop format strings from leaking into various callers, >>> have gcc stop the build when this gets detected. >>> >>> Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> >>> >>> diff --git a/Makefile b/Makefile >>> index e6a9b1b..b7684d2 100644 >>> --- a/Makefile >>> +++ b/Makefile >>> @@ -402,7 +402,6 @@ KBUILD_CPPFLAGS := -D__KERNEL__ >>> KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ >>> -fno-strict-aliasing -fno-common \ >>> -Werror-implicit-function-declaration \ >>> - -Wno-format-security \ >>> -std=gnu89 >>> >>> KBUILD_AFLAGS_KERNEL := >>> @@ -752,6 +751,11 @@ endif >>> NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include) >>> CHECKFLAGS += $(NOSTDINC_FLAGS) >>> >>> +# Enable format-security when it can stop the build, otherwise disable. >>> +KBUILD_CFLAGS += $(call cc-option,\ >>> + -Wformat -Wformat-security -Werror=format-security,\ >>> + -Wno-format-security) >>> + >>> # warn about C99 declaration after statement >>> KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,) >>> >> >> The trouble is that gcc still has a terrible time with false positives >> on these warnings. It doesn't know to silence const char strings. For >> example: >> >> const char * version = "SomeThing driver v1.3\n"; > > While the contents of the string are const, the pointer isn't... > >> ... >> printk(version); > > ... hence gcc cannot be sure version hasn't been changed to point > to something different. > >> We don't care about this, since the string is not dynamic, but gcc >> still warns. My intention is that when gcc fixes this bug, then I'd >> upstream this patch. Right now I have to carry a patch to silence >> false positives. :( > > Does it help if you change it to: > > const char * const version = "SomeThing driver v1.3\n"; Nope. :( Here's what I use when examining gcc's behavior: https://gist.github.com/kees/e561143ba0bd0ca163bc -Kees > > ??? > > Gr{oetje,eeting}s, > > Geert > > -- > Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx > > In personal conversations with technical people, I call myself a hacker. But > when I'm talking to journalists I just say "programmer" or something like that. > -- Linus Torvalds -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-leds" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
