linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v3 0/1] vsprintf: check non-canonical pointer by kern_addr_valid()
@ 2022-10-19 19:34 Jane Chu
  2022-10-19 19:34 ` [PATCH v3 1/1] vsprintf: protect kernel from panic due to non-canonical pointer dereference Jane Chu
  2022-10-20 13:12 ` [PATCH v3 0/1] vsprintf: check non-canonical pointer by kern_addr_valid() Kefeng Wang
  0 siblings, 2 replies; 12+ messages in thread
From: Jane Chu @ 2022-10-19 19:34 UTC (permalink / raw)
  To: pmladek, rostedt, senozhatsky, andriy.shevchenko, linux,
	linux-mm, linux-kernel
  Cc: wangkefeng.wang, konrad.wilk, haakon.bugge, john.haxby, jane.chu

Changes since v2 [1]:
 - revised commit comment for clarification;
 - cc linux-mm for expert's review on the kern_addr_valid() usage as suggested by Petr;
 - cc Kefeng Wang in light of his recent patch [2]

[1]: https://lore.kernel.org/lkml/288a7aba-c647-b51f-bdb3-99a62449dbb3@oracle.com/T/ 
[2]: https://lore.kernel.org/lkml/20221018074014.185687-1-wangkefeng.wang@huawei.com/

Jane Chu (1):
  vsprintf: protect kernel from panic due to non-canonical pointer
    dereference

 lib/vsprintf.c | 3 +++
 1 file changed, 3 insertions(+)

-- 
2.18.4



^ permalink raw reply	[flat|nested] 12+ messages in thread
* [PATCH v3 1/1] vsprintf: protect kernel from panic due to non-canonical pointer dereference
@ 2022-10-19 19:41 Jane Chu
  2022-10-19 20:33 ` Andy Shevchenko
                   ` (2 more replies)
  0 siblings, 3 replies; 12+ messages in thread
From: Jane Chu @ 2022-10-19 19:41 UTC (permalink / raw)
  To: pmladek, rostedt, senozhatsky, andriy.shevchenko, linux,
	linux-mm, linux-kernel
  Cc: wangkefeng.wang, konrad.wilk, haakon.bugge, john.haxby, jane.chu

Having stepped on a local kernel bug where reading sysfs has led to
out-of-bound pointer dereference by vsprintf() which led to GPF panic.
And the reason for GPF is that the OOB pointer was turned to a
non-canonical address such as 0x7665645f63616465.

vsprintf() already has this line of defense
	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
                return "(efault)";
Since a non-canonical pointer can be detected by kern_addr_valid()
on architectures that present VM holes as well as meaningful
implementation of kern_addr_valid() that detects the non-canonical
addresses, this patch adds a check on non-canonical string pointer by
kern_addr_valid() and "(efault)" to alert user that something
is wrong instead of unecessarily panic the server.

On the other hand, if the non-canonical string pointer is dereferenced
else where in the kernel, by virtue of being non-canonical, a crash
is expected to be immediate.

Signed-off-by: Jane Chu <jane.chu@oracle.com>
---
 lib/vsprintf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index c414a8d9f1ea..b38c12ef1e45 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -698,6 +698,9 @@ static const char *check_pointer_msg(const void *ptr)
 	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
 		return "(efault)";
 
+	if (!kern_addr_valid((unsigned long)ptr))
+		return "(efault)";
+
 	return NULL;
 }
 
-- 
2.18.4



^ permalink raw reply	[flat|nested] 12+ messages in thread
end of thread, other threads:[~2022-10-25  9:13 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-19 19:34 [PATCH v3 0/1] vsprintf: check non-canonical pointer by kern_addr_valid() Jane Chu
2022-10-19 19:34 ` [PATCH v3 1/1] vsprintf: protect kernel from panic due to non-canonical pointer dereference Jane Chu
2022-10-20 11:41   ` kernel test robot
2022-10-20 13:12 ` [PATCH v3 0/1] vsprintf: check non-canonical pointer by kern_addr_valid() Kefeng Wang
2022-10-19 19:41 [PATCH v3 1/1] vsprintf: protect kernel from panic due to non-canonical pointer dereference Jane Chu
2022-10-19 20:33 ` Andy Shevchenko
2022-10-20 14:52   ` Konrad Rzeszutek Wilk
2022-10-20 16:03     ` Andy Shevchenko
2022-10-25  8:40       ` Petr Mladek
2022-10-25  9:13         ` Andy Shevchenko
2022-10-19 21:00 ` Rasmus Villemoes
2022-10-20  9:28 ` Petr Mladek

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox