CFI: Mismatching function pointer casts reported by -Wcast-function-type-strict #1724

samitolvanen · 2022-09-28T21:42:17Z

I recently noticed that -Wcast-function-type only checks for ABI compatibility, which isn't sufficient to catch type mismatches with indirect call CFI, and implemented an experimental -Wcast-function-type-strict warning, which checks for exact type match for function pointer casts instead.

Enabling this diagnostic results in 1549 warnings for x86_64 allmodconfig, most of which at a quick glance look like something that could trip CFI checking. This seems like something we should look into cleaning up.

cc @kees @nickdesaulniers @lvwr @nhukc

The text was updated successfully, but these errors were encountered:

kees · 2022-09-29T10:21:32Z

$ grep 'warning: cast from ' raw | sed -e "s/ (aka .*) to / to /; s/.*' to '//; s/' (aka .*//; s/' converts.*//;" | sort | uniq -c | sort -n
      1 bfa_cb_cbfn_status_t
      1 int (*)(const void *, const void *)
      1 ipi_handler_t
      1 q6apm_cb
      1 remote_function_f
      1 void (*)(struct device *)
      1 void (*)(struct ib_event *, void *)
      1 void (*)(struct kobject *)
      1 void (*)(struct mmu_gather *, void *)
      1 void (*)(struct rq *)
      2 done_f
      2 irq_handler_t
      2 octeon_mbox_callback_t
      2 pvr2_stream_callback
      2 snd_aw2_saa7146_it_cb
      2 work_func_t
      4 bfa_cb_cbfn_t
      4 csio_sm_state_t
      4 snd_seq_dump_func_t
      4 typeof (last_func)
      5 create_t
      5 destroy_t
      5 ubifs_lpt_scan_callback
      5 void (*)(struct callback_head *)
     22 void (*)(void *)
     41 nfsd4_enc
     56 nfsd4_dec
    188 iw_handler
    316 bfa_fsm_t
    866 bfa_sm_t

kees · 2022-09-29T23:04:07Z

bfa warning fixes: https://lore.kernel.org/lkml/20220929230334.2109344-1-keescook@chromium.org

When built with Control Flow Integrity, function prototypes between caller and function declaration must match. These mismatches are visible at compile time with the new -Wcast-function-type-strict in Clang[1]. Of the 1549 warnings found, 1187 come from bfa alone. For example: drivers/scsi/bfa/bfad.c:169:3: warning: cast from 'void (*)(struct bfad_s *, enum bfad_sm_event)' to 'bfa_sm_t' (aka 'void (*)(void *, int)') converts to incompatible function type [-Wcast-function-type-strict] bfa_sm_set_state(bfad, bfad_sm_created); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The bfa state machine code heavily overloads its state machine functions, so these have been separated into their own sets of structs, enums, typedefs, and helper functions. There are almost zero binary code changes, all seem to be related to header file line numbers changing, or the addition of the new stats helper. This patch is a cleanup based on Brad Spengler/PaX Team's modifications to the bfa driver in their last public patch of grsecurity/PaX based on my understanding of the code. Changes or omissions from the original code are mine and don't reflect the original grsecurity/PaX code. [1] https://reviews.llvm.org/D134831 Cc: Anil Gurumurthy <anil.gurumurthy@qlogic.com> Cc: Sudarsana Kalluru <sudarsana.kalluru@qlogic.com> Cc: "James E.J. Bottomley" <jejb@linux.ibm.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: Nathan Chancellor <nathan@kernel.org> Cc: Nick Desaulniers <ndesaulniers@google.com> Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> Cc: llvm@lists.linux.dev Cc: linux-scsi@vger.kernel.org Reported-by: Sami Tolvanen <samitolvanen@google.com> Link: ClangBuiltLinux#1724 Signed-off-by: Kees Cook <keescook@chromium.org>

We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed. Cc: stable@vger.kernel.org Link: https://reviews.llvm.org/D134831 Link: ClangBuiltLinux#1724 Suggested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com>

kees · 2022-10-02T03:32:31Z

atmel warning fixes: https://lore.kernel.org/lkml/20221002032428.4091540-1-keescook@chromium.org

We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed. Cc: stable@vger.kernel.org Link: https://reviews.llvm.org/D134831 Link: ClangBuiltLinux#1724 Suggested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220930203310.4010564-1-samitolvanen@google.com

commit 2120635 upstream. We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed. Cc: stable@vger.kernel.org Link: https://reviews.llvm.org/D134831 Link: ClangBuiltLinux/linux#1724 Suggested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220930203310.4010564-1-samitolvanen@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2120635 upstream. We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed. Cc: stable@vger.kernel.org Link: https://reviews.llvm.org/D134831 Link: ClangBuiltLinux#1724 Suggested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220930203310.4010564-1-samitolvanen@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2120635 upstream. We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed. Cc: stable@vger.kernel.org Link: https://reviews.llvm.org/D134831 Link: ClangBuiltLinux/linux#1724 Suggested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220930203310.4010564-1-samitolvanen@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2120635108b35ecad9c59c8b44f6cbdf4f98214e upstream. We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed. Cc: stable@vger.kernel.org Link: https://reviews.llvm.org/D134831 Link: ClangBuiltLinux/linux#1724 Suggested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220930203310.4010564-1-samitolvanen@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: ironman-reborn <ironman-reborn@users.noreply.github.com> Signed-off-by: GhostMaster69-dev <rathore6375@gmail.com>

commit 2120635108b35ecad9c59c8b44f6cbdf4f98214e upstream. We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed. Cc: stable@vger.kernel.org Link: https://reviews.llvm.org/D134831 Link: ClangBuiltLinux/linux#1724 Suggested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220930203310.4010564-1-samitolvanen@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ulrich Hecht <uli+cip@fpond.eu>

commit 2120635108b35ecad9c59c8b44f6cbdf4f98214e upstream. We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed. Cc: stable@vger.kernel.org Link: https://reviews.llvm.org/D134831 Link: ClangBuiltLinux/linux#1724 Suggested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220930203310.4010564-1-samitolvanen@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2120635 upstream. We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed. Cc: stable@vger.kernel.org Link: https://reviews.llvm.org/D134831 Link: ClangBuiltLinux/linux#1724 Suggested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220930203310.4010564-1-samitolvanen@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2120635108b35ecad9c59c8b44f6cbdf4f98214e upstream. We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed. Cc: stable@vger.kernel.org Link: https://reviews.llvm.org/D134831 Link: ClangBuiltLinux/linux#1724 Suggested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220930203310.4010564-1-samitolvanen@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: ironman-reborn <ironman-reborn@users.noreply.github.com> Signed-off-by: GhostMaster69-dev <rathore6375@gmail.com> Signed-off-by: Omar Mohamed <omarcoptan9@gmail.com>

commit 2120635 upstream. We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed. Cc: stable@vger.kernel.org Link: https://reviews.llvm.org/D134831 Link: ClangBuiltLinux/linux#1724 Suggested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220930203310.4010564-1-samitolvanen@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

samitolvanen added the [FEATURE] CFI Related to building the kernel with Clang Control Flow Integrity label Sep 28, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CFI: Mismatching function pointer casts reported by -Wcast-function-type-strict #1724

CFI: Mismatching function pointer casts reported by -Wcast-function-type-strict #1724

samitolvanen commented Sep 28, 2022

kees commented Sep 29, 2022

kees commented Sep 29, 2022

kees commented Oct 2, 2022

CFI: Mismatching function pointer casts reported by -Wcast-function-type-strict #1724

CFI: Mismatching function pointer casts reported by -Wcast-function-type-strict #1724

Comments

samitolvanen commented Sep 28, 2022

kees commented Sep 29, 2022

kees commented Sep 29, 2022

kees commented Oct 2, 2022