RE: [RFC] Mitigating unexpected arithmetic overflow

[David Laight]

From: Kees Cook
> Sent: 16 May 2024 14:31
> 
> On May 15, 2024 12:36:36 AM PDT, Peter Zijlstra <peterz@xxxxxxxxxxxxx> wrote:
> >On Wed, May 08, 2024 at 04:47:25PM -0700, Linus Torvalds wrote:
> >> For example, the most common case of overflow we've ever had has very
> >> much been array indexing. Now, sometimes that has actually been actual
> >> undefined behavior, because it's been overflow in signed variables,
> >> and those are "easy" to find in the sense that you just say "no, can't
> >> do that". UBSAN finds them, and that's good.
> >
> >We build with -fno-strict-overflow, which implies -fwrapv, which removes
> >the UB from signed overflow by mandating 2s complement.
> 
> I am a broken record. :) This is _not_ about undefined behavior.
> 
> This is about finding a way to make the intent of C authors unambiguous.
> That overflow wraps is well defined. It is not always _desired_.
> C has no way to distinguish between the two cases.

I'm pretty sure that the 'undefined' behaviour of signed overflow
it so that cpu can do saturating arithmetic (useful on analogue data)
or can fault (and maybe generate a signal) and still be compliant.

The Linux kernel (and pretty much all userspace) doesn't want either
behaviour.
(Unexpected saturation leads to very confusing bugs that are as bad
as wrapping but much less obvious.)

I do wonder whether trying to remove all arithmetic on char/short
variables should be an aim.
The only reason to have char/short is to reduce the size of a structure.
A first stage would removing all short locals, function parameters
and function returns.
There will be some (sensible) false positives for char.

If you breath on a char/short it becomes 'signed int',
even (x ? 'a' : 'b') is 'signed int'.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)