From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl0-f72.google.com (mail-pl0-f72.google.com [209.85.160.72]) by kanga.kvack.org (Postfix) with ESMTP id 069996B0038 for ; Tue, 19 Dec 2017 22:50:54 -0500 (EST) Received: by mail-pl0-f72.google.com with SMTP id 61so8691861plz.1 for ; Tue, 19 Dec 2017 19:50:53 -0800 (PST) Received: from bombadil.infradead.org (bombadil.infradead.org. [65.50.211.133]) by mx.google.com with ESMTPS id n1si12072207plp.680.2017.12.19.19.50.52 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 19 Dec 2017 19:50:52 -0800 (PST) Date: Tue, 19 Dec 2017 19:50:43 -0800 From: Matthew Wilcox Subject: Re: BUG: bad usercopy in memdup_user Message-ID: <20171220035043.GA14980@bombadil.infradead.org> References: <001a113e9ca8a3affd05609d7ccf@google.com> <6a50d160-56d0-29f9-cfed-6c9202140b43@I-love.SAKURA.ne.jp> <20171219083746.GR19604@eros> <20171219132246.GD13680@bombadil.infradead.org> <20171219214849.GU21978@ZenIV.linux.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171219214849.GU21978@ZenIV.linux.org.uk> Sender: owner-linux-mm@kvack.org List-ID: To: Al Viro Cc: Linus Torvalds , "Tobin C. Harding" , Dmitry Vyukov , Kees Cook , Tetsuo Handa , Linux-MM , syzbot , David Windsor , keun-o.park@darkmatter.ae, Laura Abbott , LKML , Mark Rutland , Ingo Molnar , syzkaller-bugs@googlegroups.com, Will Deacon On Tue, Dec 19, 2017 at 09:48:49PM +0000, Al Viro wrote: > Well, for example seeing a 0xfffffffffffffff4 where a pointer to object > must have been is a pretty strong hint to start looking for a way for > that ERR_PTR(-ENOMEM) having ended up there... Something like > 0x6e69622f7273752f is almost certainly a misplaced "/usr/bin", i.e. a > pathname overwriting whatever it ends up in, etc. And yes, I have run > into both of those in real life. > > Debugging the situation when crap value has ended up in place of a > pointer is certainly a case where you do want to see what exactly has > ended up in there... Linus, how would you feel about printing ERR_PTRs without molestation? It's not going to leak any information about the kernel address space layout. I'm a little less certain about trying to detect ASCII strings, but I think this is an improvement. diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 01c3957b2de6..c80c60b4b3ef 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -1859,6 +1859,9 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, return string(buf, end, "(null)", spec); } + if (IS_ERR(ptr)) + return pointer_string(buf, end, ptr, spec); + switch (*fmt) { case 'F': case 'f': -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org