From 36cb69fc43cbce6d883b3a0da4f793c81dbf4b2e Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Fri, 3 Jun 2022 18:16:57 +0000 Subject: [PATCH 1/2] ci: build systemd with clang with -Dmode=release --optimization=2 This is what's most likely used to build systemd with clang in practice so let's test it as well. Preparation for reverting https://github.com/systemd/systemd/commit/0bd292567a543d124cd303f7dd61169a209cae64 (which replaced bogus buffer overflow found with _FORTIFY_SOURCE=3 with actual segfaults). --- .github/workflows/unit_tests.sh | 12 ++++++++---- .github/workflows/unit_tests.yml | 2 +- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/workflows/unit_tests.sh b/.github/workflows/unit_tests.sh index 442202f46a..affd1e9357 100755 --- a/.github/workflows/unit_tests.sh +++ b/.github/workflows/unit_tests.sh @@ -53,12 +53,16 @@ for phase in "${PHASES[@]}"; do apt-get -y install "${ADDITIONAL_DEPS[@]}" pip3 install -r .github/workflows/requirements.txt --require-hashes ;; - RUN|RUN_GCC|RUN_CLANG) - if [[ "$phase" = "RUN_CLANG" ]]; then + RUN|RUN_GCC|RUN_CLANG|RUN_CLANG_RELEASE) + if [[ "$phase" =~ ^RUN_CLANG ]]; then export CC=clang export CXX=clang++ - # The docs build is slow and is not affected by compiler/flags, so do it just once - MESON_ARGS+=(-Dman=true) + if [[ "$phase" == RUN_CLANG ]]; then + # The docs build is slow and is not affected by compiler/flags, so do it just once + MESON_ARGS+=(-Dman=true) + else + MESON_ARGS+=(-Dmode=release --optimization=2) + fi fi # The install_tag feature introduced in 0.60 causes meson to fail with fatal-meson-warnings # "Project targeting '>= 0.53.2' but tried to use feature introduced in '0.60.0': install_tag arg in custom_target" diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml index 4a57f409b8..2821d7fdd1 100644 --- a/.github/workflows/unit_tests.yml +++ b/.github/workflows/unit_tests.yml @@ -21,7 +21,7 @@ jobs: strategy: fail-fast: false matrix: - run_phase: [GCC, GCC_ASAN_UBSAN, CLANG, CLANG_ASAN_UBSAN, CLANG_ASAN_UBSAN_NO_DEPS] + run_phase: [GCC, GCC_ASAN_UBSAN, CLANG, CLANG_RELEASE, CLANG_ASAN_UBSAN, CLANG_ASAN_UBSAN_NO_DEPS] cryptolib: [auto] include: - run_phase: GCC From 2cfb790391958ada34284290af1f9ab863a515c7 Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Fri, 3 Jun 2022 19:06:22 +0000 Subject: [PATCH 2/2] Revert "Support -D_FORTIFY_SOURCE=3 by using __builtin_dynamic_object_size." This reverts commit 0bd292567a543d124cd303f7dd61169a209cae64. It isn't guaranteed anywhere that __builtin_dynamic_object_size can always deduce the size of every object passed to it so systemd can end up using either malloc_usable_size or __builtin_dynamic_object_size when pointers are passed around, which in turn can lead to actual segfaults like the one mentioned in https://github.com/systemd/systemd/issues/23619. Apparently __builtin_object_size can return different results for pointers referring to the same memory as well but somehow it hasn't caused any issues yet. Looks like this whole malloc_usable_size/FORTIFY_SOURCE stuff should be revisited. Closes https://github.com/systemd/systemd/issues/23619 and https://github.com/systemd/systemd/issues/23150. Reopens https://github.com/systemd/systemd/issues/22801 --- src/basic/alloc-util.h | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/src/basic/alloc-util.h b/src/basic/alloc-util.h index 155fbf5f1f..13dab0304f 100644 --- a/src/basic/alloc-util.h +++ b/src/basic/alloc-util.h @@ -174,23 +174,13 @@ void* greedy_realloc0(void **p, size_t need, size_t size); * is compatible with _FORTIFY_SOURCES. If _FORTIFY_SOURCES is used many memory operations will take the * object size as returned by __builtin_object_size() into account. Hence, let's return the smaller size of * malloc_usable_size() and __builtin_object_size() here, so that we definitely operate in safe territory by - * both the compiler's and libc's standards. Note that _FORTIFY_SOURCES=3 handles also dynamically allocated - * objects and thus it's safer using __builtin_dynamic_object_size if _FORTIFY_SOURCES=3 is used (#22801). - * Moreover, when NULL is passed malloc_usable_size() is documented to return zero, and + * both the compiler's and libc's standards. Note that __builtin_object_size() evaluates to SIZE_MAX if the + * size cannot be determined, hence the MIN() expression should be safe with dynamically sized memory, + * too. Moreover, when NULL is passed malloc_usable_size() is documented to return zero, and * __builtin_object_size() returns SIZE_MAX too, hence we also return a sensible value of 0 in this corner * case. */ - -#if defined __has_builtin -# if __has_builtin(__builtin_dynamic_object_size) -# define MALLOC_SIZEOF_SAFE(x) \ - MIN(malloc_usable_size(x), __builtin_dynamic_object_size(x, 0)) -# endif -#endif - -#ifndef MALLOC_SIZEOF_SAFE #define MALLOC_SIZEOF_SAFE(x) \ MIN(malloc_usable_size(x), __builtin_object_size(x, 0)) -#endif /* Inspired by ELEMENTSOF() but operates on malloc()'ed memory areas: typesafely returns the number of items * that fit into the specified memory block */