Al had asked me a couple weeks back what the ratio of const vs dynamic
usercopying was. With Josh's cleanup and my fix-up to only call the
hardened usercopy when non-const, I can actually gather these statistics
on a build. It's a bit of a hack (see attached patch that should not go
into the tree), but with my not-very-defconfig, it's rougly 2 to 1 const
vs dynamic.  However, this doesn't take into account the frequency at
_runtime_, which maybe could be discovered via perf comparing copy*user()
calls to __check_object_size() calls, but I didn't try that. Does someone
have perf setup to check this?

$ grep 'warning: call to' build.stderr | wc -l
$ grep 'warning: call to' build.stderr | grep 'const usercopy' | wc -l
$ grep 'warning: call to' build.stderr | grep 'dynamic usercopy' | wc -l

Signed-off-by: Kees Cook <keesc...@chromium.org>
 include/linux/thread_info.h | 8 +++++++-
 mm/usercopy.c               | 4 ++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
index 2b5b10eed74f..4cae922797e5 100644
--- a/include/linux/thread_info.h
+++ b/include/linux/thread_info.h
@@ -115,14 +115,20 @@ static inline int arch_within_stack_frames(const void * 
const stack,
-extern void __check_object_size(const void *ptr, unsigned long n,
+extern void __compiletime_warning("dynamic usercopy")
+__check_object_size(const void *ptr, unsigned long n,
                                        bool to_user);
+extern void __compiletime_warning("builtin-const usercopy")
 static __always_inline void check_object_size(const void *ptr, unsigned long n,
                                              bool to_user)
        if (!__builtin_constant_p(n))
                __check_object_size(ptr, n, to_user);
+       else
+               __skip_check_object_size();
 static inline void check_object_size(const void *ptr, unsigned long n,
diff --git a/mm/usercopy.c b/mm/usercopy.c
index 089328f2b920..9969a06f5e25 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -275,3 +275,7 @@ report:
        report_usercopy(ptr, n, to_user, err);
+void __skip_check_object_size(void)
+{ }

Kees Cook
Nexus Security

Reply via email to