[Bug sanitizer/81715] asan-stack=1 redzone allocation is too inflexible
arnd at linaro dot org
gcc-bugzilla@gcc.gnu.org
Wed Sep 20 19:58:00 GMT 2017
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715
--- Comment #13 from Arnd Bergmann <arnd at linaro dot org> ---
Tested the fix with an x86 allmodconfig kernel (linux-next, with
-fsanitize-address-use-after-scope disabled manually). With an arbitrary limit
of 1500 bytes (the default is no limit when -fsanitize=kernel-address is used),
I get 46 warnings in 22 files without the fix, including the two files I
attached earlier.
With the patch applied, only six warnings remain, and they are all below 2048
bytes (which I would then suggest as the new warning limit for sanitized
kernels):
net/caif/cfctrl.c:555:1: error: the frame size of 1568 bytes is larger than
1500 bytes [-Werror=frame-larger-than=]
drivers/crypto/qat/qat_common/qat_hal.c:963:1: error: the frame size of 1800
bytes is larger than 1500 bytes [-Werror=frame-larger-than=]
drivers/input/mouse/cyapa_gen5.c:2434:1: error: the frame size of 1920 bytes is
larger than 1500 bytes [-Werror=frame-larger-than=]
drivers/isdn/hardware/eicon/message.c:5984:1: error: the frame size of 2016
bytes is larger than 1500 bytes [-Werror=frame-larger-than=]
drivers/media/tuners/tda8290.c:310:1: error: the frame size of 1664 bytes is
larger than 1500 bytes [-Werror=frame-larger-than=]
drivers/staging/rtl8712/rtl871x_ioctl_linux.c:335:1: error: the frame size of
1712 bytes is larger than 1500 bytes [-Werror=frame-larger-than=]
This is wonderful, it almost solves the entire problem that I have spent
several weeks on finding workarounds for over the past year.
I would still like to see the redzone size change we discussed earlier, to help
with the remaining warnings (I'd have to look at the six files I mentioned to
see if they would benefit, will open another PR if I see a third problem in
there) and with the -fsanitize-address-use-after-scope case. I'll also try to
work around unpatched gcc-5/6/7 compilers by using the local variable trick
from comment 11 for the worst cases.
More information about the Gcc-bugs
mailing list