From: Joe Perches <joe@perches•com>
To: "Tobin C. Harding" <me@tobin•cc>,
Andrew Morton <akpm@linux-foundation•org>
Cc: kernel-hardening@lists•openwall.com,
Linus Torvalds <torvalds@linux-foundation•org>,
"Jason A. Donenfeld" <Jason@zx2c4•com>,
Theodore Ts'o <tytso@mit•edu>, Kees Cook <keescook@chromium•org>,
Paolo Bonzini <pbonzini@redhat•com>,
Tycho Andersen <tycho@tycho•ws>,
"Roberts, William C" <william.c.roberts@intel•com>,
Tejun Heo <tj@kernel•org>,
Jordan Glover <Golden_Miller83@protonmail•ch>,
Greg KH <gregkh@linuxfoundation•org>,
Petr Mladek <pmladek@suse•com>, Ian Campbell <ijc@hellion•org.uk>,
Sergey Senozhatsky <sergey.senozhatsky@gmail•com>,
Catalin Marinas <catalin.marinas@arm•com>,
Will Deacon <wilal.deacon@arm•com>,
Steven Rostedt <rostedt@goodmis•org>,
Chris Fries <cfries@google•com>,
Dave Weinstein <olorin@google•com>,
Daniel Micay <d
Subject: Re: [PATCH V11 4/5] vsprintf: add printk specifier %px
Date: Wed, 29 Nov 2017 19:58:26 -0800 [thread overview]
Message-ID: <1512014306.19952.80.camel@perches.com> (raw)
In-Reply-To: <20171129232603.GO6217@eros>
On Thu, 2017-11-30 at 10:26 +1100, Tobin C. Harding wrote:
> On Wed, Nov 29, 2017 at 03:20:58PM -0800, Andrew Morton wrote:
> > On Wed, 29 Nov 2017 13:05:04 +1100 "Tobin C. Harding" <me@tobin•cc> wrote:
> >
> > > printk specifier %p now hashes all addresses before printing. Sometimes
> > > we need to see the actual unmodified address. This can be achieved using
> > > %lx but then we face the risk that if in future we want to change the
> > > way the Kernel handles printing of pointers we will have to grep through
> > > the already existent 50 000 %lx call sites. Let's add specifier %px as a
> > > clear, opt-in, way to print a pointer and maintain some level of
> > > isolation from all the other hex integer output within the Kernel.
> > >
> > > Add printk specifier %px to print the actual unmodified address.
> > >
> > > ...
> > >
> > > +Unmodified Addresses
> > > +====================
> > > +
> > > +::
> > > +
> > > + %px 01234567 or 0123456789abcdef
> > > +
> > > +For printing pointers when you _really_ want to print the address. Please
> > > +consider whether or not you are leaking sensitive information about the
> > > +Kernel layout in memory before printing pointers with %px. %px is
> > > +functionally equivalent to %lx. %px is preferred to %lx because it is more
> > > +uniquely grep'able. If, in the future, we need to modify the way the Kernel
> > > +handles printing pointers it will be nice to be able to find the call
> > > +sites.
> > > +
> >
> > You might want to add a checkpatch rule which emits a stern
> > do-you-really-want-to-do-this warning when someone uses %px.
> >
>
> Oh, nice idea. It has to be a CHECK but right?
No, it has to be something that's not --strict
so a WARN would probably be best.
> By stern, you mean use stern language?
I hope he doesn't mean tweet.
Something like:
---
scripts/checkpatch.pl | 31 +++++++++++++++++++++++++------
1 file changed, 25 insertions(+), 6 deletions(-)
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 0ce249f157a1..9d789cbe7df5 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -5758,21 +5758,40 @@ sub process {
defined $stat &&
$stat =~ /^\+(?![^\{]*\{\s*).*\b(\w+)\s*\(.*$String\s*,/s &&
$1 !~ /^_*volatile_*$/) {
+ my $complete_extension = "";
+ my $extension = "";
my $bad_extension = "";
my $lc = $stat =~ tr@\n@@;
$lc = $lc + $linenr;
+ my $stat_real;
for (my $count = $linenr; $count <= $lc; $count++) {
my $fmt = get_quoted_string($lines[$count - 1], raw_line($count, 0));
$fmt =~ s/%%//g;
- if ($fmt =~ /(\%[\*\d\.]*p(?![\WFfSsBKRraEhMmIiUDdgVCbGNO]).)/) {
- $bad_extension = $1;
- last;
+ while ($fmt =~ /(\%[\*\d\.]*p(\w))/g) {
+ $complete_extension = $1;
+ $extension = $2;
+ if ($extension !~ /[FfSsBKRraEhMmIiUDdgVCbGNOx]/) {
+ $bad_extension = $complete_extension;
+ last;
+ }
+ if ($extension eq "x") {
+ if (!defined($stat_real)) {
+ $stat_real = raw_line($linenr, 0);
+ for (my $count = $linenr + 1; $count <= $lc; $count++) {
+ $stat_real = $stat_real . "\n" . raw_line($count, 0);
+ }
+ }
+ WARN("VSPRINTF_POINTER_PX",
+ "Using vsprintf pointer extension '$complete_extension' exposes kernel address for possible hacking\n" . "$here\n$stat_real\n");
+ }
}
}
if ($bad_extension ne "") {
- my $stat_real = raw_line($linenr, 0);
- for (my $count = $linenr + 1; $count <= $lc; $count++) {
- $stat_real = $stat_real . "\n" . raw_line($count, 0);
+ if (!defined($stat_real)) {
+ $stat_real = raw_line($linenr, 0);
+ for (my $count = $linenr + 1; $count <= $lc; $count++) {
+ $stat_real = $stat_real . "\n" . raw_line($count, 0);
+ }
}
WARN("VSPRINTF_POINTER_EXTENSION",
"Invalid vsprintf pointer extension '$bad_extension'\n" . "$here\n$stat_real\n");
next prev parent reply other threads:[~2017-11-30 3:58 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-29 2:05 [PATCH V11 0/5] hash addresses printed with %p Tobin C. Harding
2017-11-29 2:05 ` [PATCH V11 1/5] docs: correct documentation for %pK Tobin C. Harding
2017-11-29 2:05 ` [PATCH V11 2/5] vsprintf: refactor %pK code out of pointer() Tobin C. Harding
2017-11-29 2:39 ` Steven Rostedt
2017-11-29 4:27 ` Tobin C. Harding
2017-11-29 11:54 ` Steven Rostedt
2017-11-29 2:05 ` [PATCH V11 3/5] printk: hash addresses printed with %p Tobin C. Harding
2017-11-29 23:21 ` Andrew Morton
2017-12-05 20:20 ` Geert Uytterhoeven
2017-12-05 20:31 ` David Miller
2017-12-06 10:31 ` David Laight
2017-12-06 23:21 ` Kees Cook
2017-12-06 23:28 ` Linus Torvalds
2017-12-05 20:44 ` Tobin C. Harding
2017-12-05 22:57 ` Geert Uytterhoeven
2017-12-05 23:33 ` Linus Torvalds
2017-12-06 8:48 ` Geert Uytterhoeven
2017-11-29 2:05 ` [PATCH V11 4/5] vsprintf: add printk specifier %px Tobin C. Harding
2017-11-29 2:29 ` Linus Torvalds
2017-11-29 4:29 ` Tobin C. Harding
2017-11-29 10:07 ` David Laight
2017-11-29 22:28 ` Kees Cook
2017-11-29 22:36 ` Roberts, William C
2017-11-29 22:47 ` Linus Torvalds
2017-11-30 10:38 ` David Laight
2017-12-05 21:08 ` Randy Dunlap
2017-12-05 21:22 ` Linus Torvalds
2017-12-06 1:36 ` Sergey Senozhatsky
2017-12-06 1:59 ` Linus Torvalds
2017-12-06 2:15 ` Sergey Senozhatsky
2017-12-06 8:32 ` Geert Uytterhoeven
2017-12-06 8:45 ` Sergey Senozhatsky
2017-12-07 5:17 ` Tobin C. Harding
2017-12-07 5:29 ` Linus Torvalds
2017-12-07 5:37 ` Sergey Senozhatsky
2017-12-07 5:12 ` Tobin C. Harding
2017-11-29 23:20 ` Andrew Morton
2017-11-29 23:26 ` Tobin C. Harding
2017-11-30 3:58 ` Joe Perches [this message]
2017-11-30 4:18 ` Tobin C. Harding
2017-11-30 4:41 ` Joe Perches
2017-11-30 5:00 ` Tobin C. Harding
2017-11-29 2:05 ` [PATCH V11 5/5] kasan: use %px to print addresses instead of %p Tobin C. Harding
2017-11-29 23:20 ` [PATCH V11 0/5] hash addresses printed with %p Andrew Morton
2017-11-29 23:34 ` Tobin C. Harding
2017-11-30 10:23 ` David Laight
2017-11-30 10:26 ` Sergey Senozhatsky
2017-12-01 6:15 ` Sergey Senozhatsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1512014306.19952.80.camel@perches.com \
--to=joe@perches$(echo .)com \
--cc=Golden_Miller83@protonmail$(echo .)ch \
--cc=Jason@zx2c4$(echo .)com \
--cc=akpm@linux-foundation$(echo .)org \
--cc=catalin.marinas@arm$(echo .)com \
--cc=cfries@google$(echo .)com \
--cc=gregkh@linuxfoundation$(echo .)org \
--cc=ijc@hellion$(echo .)org.uk \
--cc=keescook@chromium$(echo .)org \
--cc=kernel-hardening@lists$(echo .)openwall.com \
--cc=me@tobin$(echo .)cc \
--cc=olorin@google$(echo .)com \
--cc=pbonzini@redhat$(echo .)com \
--cc=pmladek@suse$(echo .)com \
--cc=rostedt@goodmis$(echo .)org \
--cc=sergey.senozhatsky@gmail$(echo .)com \
--cc=tj@kernel$(echo .)org \
--cc=torvalds@linux-foundation$(echo .)org \
--cc=tycho@tycho$(echo .)ws \
--cc=tytso@mit$(echo .)edu \
--cc=wilal.deacon@arm$(echo .)com \
--cc=william.c.roberts@intel$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox