[TCWG CI] Regression caused by linux: Makefile: Enable -Warray-bounds: commit 4ba545781e20f49cf1175e11d9f606e621040acf Author: Kees Cook keescook@chromium.org

Makefile: Enable -Warray-bounds

Results regressed to # reset_artifacts: -10 # build_abe binutils: -9 # build_abe stage1: -5 # build_abe qemu: -2 # linux_n_obj: 19475 # First few build errors in logs: # 00:00:54 ./arch/arm/include/asm/io.h:113:9: error: array subscript 0 is outside array bounds of ‘const volatile void[0]’ [-Werror=array-bounds] # 00:00:54 ./arch/arm/include/asm/io.h:95:9: error: array subscript 0 is outside array bounds of ‘volatile void[0]’ [-Werror=array-bounds] # 00:00:54 ./arch/arm/include/asm/io.h:113:9: error: array subscript 0 is outside array bounds of ‘const volatile void[0]’ [-Werror=array-bounds] # 00:00:54 ./arch/arm/include/asm/io.h:95:9: error: array subscript 0 is outside array bounds of ‘volatile void[0]’ [-Werror=array-bounds] # 00:00:54 ./arch/arm/include/asm/io.h:113:9: error: array subscript 0 is outside array bounds of ‘const volatile void[0]’ [-Werror=array-bounds] # 00:00:54 ./arch/arm/include/asm/io.h:95:9: error: array subscript 0 is outside array bounds of ‘volatile void[0]’ [-Werror=array-bounds] # 00:00:54 ./arch/arm/include/asm/io.h:113:9: error: array subscript 0 is outside array bounds of ‘const volatile void[0]’ [-Werror=array-bounds] # 00:00:54 ./arch/arm/include/asm/io.h:95:9: error: array subscript 0 is outside array bounds of ‘volatile void[0]’ [-Werror=array-bounds] # 00:00:54 ./arch/arm/include/asm/io.h:113:9: error: array subscript 0 is outside array bounds of ‘const volatile void[0]’ [-Werror=array-bounds] # 00:00:54 ./arch/arm/include/asm/io.h:95:9: error: array subscript 0 is outside array bounds of ‘volatile void[0]’ [-Werror=array-bounds]

from # reset_artifacts: -10 # build_abe binutils: -9 # build_abe stage1: -5 # build_abe qemu: -2 # linux_n_obj: 19597 # First few build errors in logs: # 00:01:09 arch/arm/kernel/ptrace.c:438:40: error: ‘arch_ctrl’ is used uninitialized [-Werror=uninitialized] # 00:01:09 arch/arm/kernel/ptrace.c:484:40: error: ‘ctrl’ is used uninitialized [-Werror=uninitialized] # 00:01:11 make[2]: *** [scripts/Makefile.build:288: arch/arm/kernel/ptrace.o] Error 1 # 00:01:17 arch/arm/kernel/module-plts.c:127:21: error: statement will never be executed [-Werror=switch-unreachable] # 00:01:18 make[2]: *** [scripts/Makefile.build:288: arch/arm/kernel/module-plts.o] Error 1 # 00:01:31 sound/core/oss/mixer_oss.c:1057:21: error: ‘slot’ is used uninitialized [-Werror=uninitialized] # 00:01:31 sound/core/oss/pcm_oss.c:108:29: error: ‘t’ is used uninitialized [-Werror=uninitialized] # 00:01:31 sound/core/oss/pcm_oss.c:2998:51: error: ‘template’ is used uninitialized [-Werror=uninitialized] # 00:01:33 make[3]: *** [scripts/Makefile.build:288: sound/core/oss/mixer_oss.o] Error 1 # 00:01:34 sound/core/oss/pcm_oss.c:2488:34: error: ‘setup’ is used uninitialized [-Werror=uninitialized]

THIS IS THE END OF INTERESTING STUFF. BELOW ARE LINKS TO BUILDS, REPRODUCTION INSTRUCTIONS, AND THE RAW COMMIT.

This commit has regressed these CI configurations: - tcwg_kernel/gnu-master-arm-next-allyesconfig

First_bad build: https://ci.linaro.org/job/tcwg_kernel-gnu-bisect-gnu-master-arm-next-allyesc... Last_good build: https://ci.linaro.org/job/tcwg_kernel-gnu-bisect-gnu-master-arm-next-allyesc... Baseline build: https://ci.linaro.org/job/tcwg_kernel-gnu-bisect-gnu-master-arm-next-allyesc... Even more details: https://ci.linaro.org/job/tcwg_kernel-gnu-bisect-gnu-master-arm-next-allyesc...

Reproduce builds: <cut> mkdir investigate-linux-4ba545781e20f49cf1175e11d9f606e621040acf cd investigate-linux-4ba545781e20f49cf1175e11d9f606e621040acf

# Fetch scripts git clone https://git.linaro.org/toolchain/jenkins-scripts

# Fetch manifests and test.sh script mkdir -p artifacts/manifests curl -o artifacts/manifests/build-baseline.sh https://ci.linaro.org/job/tcwg_kernel-gnu-bisect-gnu-master-arm-next-allyesc... --fail curl -o artifacts/manifests/build-parameters.sh https://ci.linaro.org/job/tcwg_kernel-gnu-bisect-gnu-master-arm-next-allyesc... --fail curl -o artifacts/test.sh https://ci.linaro.org/job/tcwg_kernel-gnu-bisect-gnu-master-arm-next-allyesc... --fail chmod +x artifacts/test.sh

# Reproduce the baseline build (build all pre-requisites) ./jenkins-scripts/tcwg_kernel-build.sh @@ artifacts/manifests/build-baseline.sh

# Save baseline build state (which is then restored in artifacts/test.sh) mkdir -p ./bisect rsync -a --del --delete-excluded --exclude /bisect/ --exclude /artifacts/ --exclude /linux/ ./ ./bisect/baseline/

cd linux

# Reproduce first_bad build git checkout --detach 4ba545781e20f49cf1175e11d9f606e621040acf ../artifacts/test.sh

# Reproduce last_good build git checkout --detach 2cb06c87c9ddbe0801fd1d94def2e24703772224 ../artifacts/test.sh

cd .. </cut>

Full commit (up to 1000 lines): <cut> commit 4ba545781e20f49cf1175e11d9f606e621040acf Author: Kees Cook keescook@chromium.org Date: Fri Jun 18 23:30:07 2021 -0700

Makefile: Enable -Warray-bounds

With the recent fixes for flexible arrays and expanded FORTIFY_SOURCE coverage, it is now possible to enable -Warray-bounds. Since both GCC and Clang include -Warray-bounds in -Wall, adjust the Makefile to just stop disabling it.

Note that this option can be conservative in its warnings (which is done at casting time rather than access time), but this is reasonable since the cast variables may be accessed out of a scope where the true size of the original object can't be evaluated. These handful of false positives (which are arguably bad casts and can be easily avoided), are worth dealing with because of the many places where this option has helped identify missed bounds checks and even accesses done against cases where a NULL pointer could be reached.

https://github.com/KSPP/linux/issues/109 https://github.com/KSPP/linux/issues/151

Cc: Arnd Bergmann arnd@arndb.de Cc: Masahiro Yamada masahiroy@kernel.org Cc: linux-kbuild@vger.kernel.org Co-developed-by: Gustavo A. R. Silva gustavoars@kernel.org Signed-off-by: Gustavo A. R. Silva gustavoars@kernel.org Signed-off-by: Kees Cook keescook@chromium.org --- Makefile | 1 - 1 file changed, 1 deletion(-)

diff --git a/Makefile b/Makefile index 0fb4f94a6885..71c313b90a2b 100644 --- a/Makefile +++ b/Makefile @@ -952,7 +952,6 @@ KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation)

# We'll want to enable this eventually, but it's not going away for 5.7 at least KBUILD_CFLAGS += $(call cc-disable-warning, zero-length-bounds) -KBUILD_CFLAGS += -Wno-array-bounds KBUILD_CFLAGS += $(call cc-disable-warning, stringop-overflow)

# Another good warning that we'll want to enable eventually </cut>