X-Original-To: alpine-devel@lists.alpinelinux.org
Received: from mail.wilcox-tech.com (mail.wilcox-tech.com [45.32.83.9])
	by lists.alpinelinux.org (Postfix) with ESMTP id 94146F8319C
	for <alpine-devel@lists.alpinelinux.org>; Mon, 25 Feb 2019 17:27:13 +0000 (UTC)
Received: (qmail 21992 invoked from network); 25 Feb 2019 17:27:01 -0000
Received: from localhost (HELO ?IPv6:2600:380:563a:1775:3dda:8bbf:7abc:8bcb?) (AWilcox@Wilcox-Tech.com@127.0.0.1)
  by localhost with ESMTPA; 25 Feb 2019 17:27:01 -0000
Content-Type: multipart/alternative;
	boundary=Apple-Mail-2AB9638B-6A42-47C5-9DB2-926B04DC7801
X-Mailinglist: alpine-devel
Precedence: list
List-Id: Alpine Development <alpine-devel.lists.alpinelinux.org>
List-Unsubscribe: 
	<mailto:alpine-devel+unsubscribe@lists.alpinelinux.org?subject=unsubscribe>
List-Post: <mailto:alpine-devel@lists.alpinelinux.org>
List-Help: <mailto:alpine-devel+help@lists.alpinelinux.org?subject=help>
List-Subscribe: 
	<mailto:alpine-devel+subscribe@lists.alpinelinux.org?subject=subscribe>
Mime-Version: 1.0 (1.0)
Subject: Re: [alpine-devel] fortify-headers needs replacement
From: "A. Wilcox" <awilfox@adelielinux.org>
X-Mailer: iPhone Mail (15E302)
In-Reply-To: <1394950117.20190225162429@mobile-stream.com>
Date: Mon, 25 Feb 2019 11:26:52 -0600
Cc: alpine-devel@lists.alpinelinux.org
Content-Transfer-Encoding: 7bit
Message-Id: <1E8EE98E-FBEC-460A-AD48-A9EB1BA0CFA9@adelielinux.org>
References: <1394950117.20190225162429@mobile-stream.com>
To: alpine-mips-patches <info@mobile-stream.com>


--Apple-Mail-2AB9638B-6A42-47C5-9DB2-926B04DC7801
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable

On Feb 25, 2019, at 7:24 AM, alpine-mips-patches <info@mobile-stream.com> wr=
ote:
>=20
> (this e-mail is a resend triggered by the aports commit 228579f6c7663dc410=
7b1b418367e968513277f9)
>=20
> This is some dumb program:
>=20
> #include <string.h>
> int main(int argc, char **argv)
> {
>        int x;
>        memcpy(&x, &argc, sizeof x);
>        return x;
> }
>=20
> This is what it turns into when compiled with "gcc -Os -fomit-frame-pointe=
r" on edge (or 3.8.1):
>=20
> 0000000000001068 <main>:
>    1068:       48 83 ec 28             sub    $0x28,%rsp
>    106c:       89 7c 24 0c             mov    %edi,0xc(%rsp)
>    1070:       48 8d 7c 24 14          lea    0x14(%rsp),%rdi
>    1075:       48 8d 74 24 0c          lea    0xc(%rsp),%rsi
>    107a:       64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
>    1081:       00 00=20
>    1083:       48 89 44 24 18          mov    %rax,0x18(%rsp)
>    1088:       31 c0                   xor    %eax,%eax
>    108a:       48 8d 47 04             lea    0x4(%rdi),%rax
>    108e:       48 39 c6                cmp    %rax,%rsi
>    1091:       73 05                   jae    1098 <main+0x30>
>    1093:       48 39 f7                cmp    %rsi,%rdi
>    1096:       72 0e                   jb     10a6 <main+0x3e>
>    1098:       48 8d 46 04             lea    0x4(%rsi),%rax
>    109c:       48 39 c7                cmp    %rax,%rdi
>    109f:       73 07                   jae    10a8 <main+0x40>
>    10a1:       48 39 f7                cmp    %rsi,%rdi
>    10a4:       76 02                   jbe    10a8 <main+0x40>
>    10a6:       0f 0b                   ud2   =20
>    10a8:       ba 04 00 00 00          mov    $0x4,%edx
>    10ad:       e8 6e ff ff ff          callq  1020 <memcpy@plt>
>    10b2:       8b 44 24 14             mov    0x14(%rsp),%eax
>    10b6:       48 8b 4c 24 18          mov    0x18(%rsp),%rcx
>    10bb:       64 48 33 0c 25 28 00    xor    %fs:0x28,%rcx
>    10c2:       00 00=20
>    10c4:       74 05                   je     10cb <main+0x63>
>    10c6:       e8 65 ff ff ff          callq  1030 <__stack_chk_fail@plt>
>    10cb:       48 83 c4 28             add    $0x28,%rsp
>    10cf:       c3                      retq  =20
>=20
> Now when compiled with "gcc -U_FORTIFY_SOURCE -Os -fomit-frame-pointer":
>=20
> 0000000000001048 <main>:
>    1048:       89 f8                   mov    %edi,%eax
>    104a:       c3                      retq  =20
>=20
>=20
> -O2, -O3 make no difference of course.
>=20
> Is this considered acceptable? What is the point of such bounds checking?
>=20
> The example is quite realistic actually, there are tons of code that use
> memcpy(&same_type_struct1, &same_type_struct0, sizeof(same_type_struct1))
> in critical paths instead of copy assignments.
>=20
> Or compressors that depend heavily on efficient memcpy within buffer with
> pre-verified boundaries. E.g. commenting out just fortify/string.h:memcpy
> and rebuilding lz4 gives 10x decompression speed-up (or merely restores
> the designed performance).
>=20
> Nothing like this happens with glibc implementation of _FORTIFY_HEADERS=3D=
2.


FWIW, we (Ad=C3=A9lie) dropped fortify-headers entirely. GCC has gotten good=
 enough at detecting egregious errors and warn/error on them. It not only ca=
uses slow downs but over a dozen compilation errors in our package tree.

--
A. Wilcox (Sent from my iPhone - not signed)
Project Lead, Ad=C3=A9lie Linux
https://www.adelielinux.org=

--Apple-Mail-2AB9638B-6A42-47C5-9DB2-926B04DC7801
Content-Type: text/html;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset=3D=
utf-8"></head><body dir=3D"auto">On Feb 25, 2019, at 7:24 AM, alpine-mips-pa=
tches &lt;<a href=3D"mailto:info@mobile-stream.com">info@mobile-stream.com</=
a>&gt; wrote:<br><div><div><br></div><blockquote type=3D"cite"><div><span>(t=
his e-mail is a resend triggered by the aports commit 228579f6c7663dc4107b1b=
418367e968513277f9)</span><br><span></span><br><span>This is some dumb progr=
am:</span><br><span></span><br><span>#include &lt;string.h&gt;</span><br><sp=
an>int main(int argc, char **argv)</span><br><span>{</span><br><span> &nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;int x;</span><br><span> &nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;memcpy(&amp;x, &amp;argc, sizeof x);</span><br><sp=
an> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return x;</span><br><span>}</s=
pan><br><span></span><br><span>This is what it turns into when compiled with=
 "gcc -Os -fomit-frame-pointer" on edge (or 3.8.1):</span><br><span></span><=
br><span>0000000000001068 &lt;main&gt;:</span><br><span> &nbsp;&nbsp;&nbsp;1=
068: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;48 83 ec 28 &nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sub &nbsp;&nbsp;&nbsp;$0x28=
,%rsp</span><br><span> &nbsp;&nbsp;&nbsp;106c: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;89 7c 24 0c &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;mov &nbsp;&nbsp;&nbsp;%edi,0xc(%rsp)</span><br><span> &nbsp;&=
nbsp;&nbsp;1070: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;48 8d 7c 24 14 &nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;lea &nbsp;&nbsp;&nbsp;0x14(%rs=
p),%rdi</span><br><span> &nbsp;&nbsp;&nbsp;1075: &nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;48 8d 74 24 0c &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;lea &nbsp;&nbsp;&nbsp;0xc(%rsp),%rsi</span><br><span> &nbsp;&nbsp;&nbsp;10=
7a: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;64 48 8b 04 25 28 00 &nbsp;&nbsp;&nb=
sp;mov &nbsp;&nbsp;&nbsp;%fs:0x28,%rax</span><br><span> &nbsp;&nbsp;&nbsp;10=
81: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;00 00 </span><br><span> &nbsp;&nbsp;=
&nbsp;1083: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;48 89 44 24 18 &nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;mov &nbsp;&nbsp;&nbsp;%rax,0x18(%rs=
p)</span><br><span> &nbsp;&nbsp;&nbsp;1088: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;31 c0 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;xor &nbsp;&nbsp;&nbsp;%eax,%eax</s=
pan><br><span> &nbsp;&nbsp;&nbsp;108a: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;4=
8 8d 47 04 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;lea &nbsp;&nbsp;&nbsp;0x4(%rdi),%rax</span><br><span> &nbsp;&nbsp;&nb=
sp;108e: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;48 39 c6 &nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cmp &nbs=
p;&nbsp;&nbsp;%rax,%rsi</span><br><span> &nbsp;&nbsp;&nbsp;1091: &nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;73 05 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;jae &nbsp;&nb=
sp;&nbsp;1098 &lt;main+0x30&gt;</span><br><span> &nbsp;&nbsp;&nbsp;1093: &nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;48 39 f7 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cmp &nbsp;&nbsp;&nbs=
p;%rsi,%rdi</span><br><span> &nbsp;&nbsp;&nbsp;1096: &nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;72 0e &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;jb &nbsp;&nbsp;&nbsp;&nbs=
p;10a6 &lt;main+0x3e&gt;</span><br><span> &nbsp;&nbsp;&nbsp;1098: &nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;48 8d 46 04 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;lea &nbsp;&nbsp;&nbsp;0x4(%rsi),%rax</span=
><br><span> &nbsp;&nbsp;&nbsp;109c: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;48 3=
9 c7 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;cmp &nbsp;&nbsp;&nbsp;%rax,%rdi</span><br><span> &nbsp;&n=
bsp;&nbsp;109f: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;73 07 &nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;jae &nbsp;&nbsp;&nbsp;10a8 &lt;main+0x40&gt;</span><br><span> &=
nbsp;&nbsp;&nbsp;10a1: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;48 39 f7 &nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;cmp &nbsp;&nbsp;&nbsp;%rsi,%rdi</span><br><span> &nbsp;&nbsp;&nbsp;10a=
4: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;76 02 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;jbe &nbsp;&nbsp;&nbsp;10a8 &lt;main+0x40&gt;</span><br><span> &nbsp;&nbsp;&=
nbsp;10a6: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0f 0b &nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;ud2 &nbsp;&nbsp;&nbsp;</span><br><span> &nbsp;&nbsp;&nbsp;10a8: &nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ba 04 00 00 00 &nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;mov &nbsp;&nbsp;&nbsp;$0x4,%edx</span><br><span> &=
nbsp;&nbsp;&nbsp;10ad: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;e8 6e ff ff ff &n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;callq &nbsp;1020 &lt;mem=
cpy@plt&gt;</span><br><span> &nbsp;&nbsp;&nbsp;10b2: &nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;8b 44 24 14 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;mov &nbsp;&nbsp;&nbsp;0x14(%rsp),%eax</span><br><span> &=
nbsp;&nbsp;&nbsp;10b6: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;48 8b 4c 24 18 &n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;mov &nbsp;&nbsp;&nbsp;0x=
18(%rsp),%rcx</span><br><span> &nbsp;&nbsp;&nbsp;10bb: &nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;64 48 33 0c 25 28 00 &nbsp;&nbsp;&nbsp;xor &nbsp;&nbsp;&nbsp;=
%fs:0x28,%rcx</span><br><span> &nbsp;&nbsp;&nbsp;10c2: &nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;00 00 </span><br><span> &nbsp;&nbsp;&nbsp;10c4: &nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;74 05 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;je &nbsp;&nbsp;=
&nbsp;&nbsp;10cb &lt;main+0x63&gt;</span><br><span> &nbsp;&nbsp;&nbsp;10c6: &=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;e8 65 ff ff ff &nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;callq &nbsp;1030 &lt;__stack_chk_fail@plt&gt;</s=
pan><br><span> &nbsp;&nbsp;&nbsp;10cb: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;4=
8 83 c4 28 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;add &nbsp;&nbsp;&nbsp;$0x28,%rsp</span><br><span> &nbsp;&nbsp;&nbsp;1=
0cf: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;c3 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;retq &nbsp;&nbsp;</span><br><span></span><br><span>Now whe=
n compiled with "gcc -U_FORTIFY_SOURCE -Os -fomit-frame-pointer":</span><br>=
<span></span><br><span>0000000000001048 &lt;main&gt;:</span><br><span> &nbsp=
;&nbsp;&nbsp;1048: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;89 f8 &nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;mov &nbsp;&nbsp;&nbsp;%edi,%eax</span><br><span> &nbsp;&nbs=
p;&nbsp;104a: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;c3 &nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;retq &nbsp;&nbsp;</span><br><span></span><br><spa=
n></span><br><span>-O2, -O3 make no difference of course.</span><br><span></=
span><br><span>Is this considered acceptable? What is the point of such boun=
ds checking?</span><br><span></span><br><span>The example is quite realistic=
 actually, there are tons of code that use</span><br><span>memcpy(&amp;same_=
type_struct1, &amp;same_type_struct0, sizeof(same_type_struct1))</span><br><=
span>in critical paths instead of copy assignments.</span><br><span></span><=
br><span>Or compressors that depend heavily on efficient memcpy within buffe=
r with</span><br><span>pre-verified boundaries. E.g. commenting out just for=
tify/string.h:memcpy</span><br><span>and rebuilding lz4 gives 10x decompress=
ion speed-up (or merely restores</span><br><span>the designed performance).<=
/span><br><span></span><br><span>Nothing like this happens with glibc implem=
entation of _FORTIFY_HEADERS=3D2.</span><br></div></blockquote><br></div><di=
v><br></div><div><span style=3D"background-color: rgba(255, 255, 255, 0);">FW=
IW, we (Ad=C3=A9lie) dropped fortify-headers entirely. GCC has gotten good e=
nough at detecting egregious errors and warn/error on them. It not only caus=
es slow downs but over a dozen compilation errors in our package tree.</span=
><div><span style=3D"background-color: rgba(255, 255, 255, 0);"><br></span><=
div><div style=3D"direction: inherit;"><span style=3D"background-color: rgba=
(255, 255, 255, 0);">--</span></div><div style=3D"direction: inherit;"><span=
 style=3D"background-color: rgba(255, 255, 255, 0);">A. Wilcox (Sent from my=
 iPhone - not signed)</span></div><div style=3D"direction: inherit;"><span s=
tyle=3D"background-color: rgba(255, 255, 255, 0);">Project Lead, Ad=C3=A9lie=
 Linux</span></div><div style=3D"direction: inherit;"><span style=3D"backgro=
und-color: rgba(255, 255, 255, 0);"><a href=3D"https://www.adelielinux.org">=
https://www.adelielinux.org</a></span></div></div></div></div></body></html>=

--Apple-Mail-2AB9638B-6A42-47C5-9DB2-926B04DC7801--


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---