[kernel-hardening] Re: Format string gcc-plugin?

[Rasmus Villemoes <linux@rasmusvillemoes.dk>]

On Tue, Feb 14 2017, Kees Cook <keescook@chromium.org> wrote:

> On Tue, Feb 14, 2017 at 10:01 AM, Laura Abbott <labbott@redhat.com> wrote:
>> Hi,
>>
>> The recent discussions about %pk led me to start playing around
>> with writing a gcc plugin (notes about writing a gcc plugin are
>> forthcoming). My idea was to expand checking of the kernel's additional
>> formats (%pK, %pR etc.) or possibly even change the format
>> strings. The big issue is that most of vsprintf.c would end up
>> in the plugin which would be ugly to maintain. This concept could
>> be used for some of the problems with kernel pointer leaks
>> https://kernsec.org/wiki/index.php/Bug_Classes/Kernel_pointer_leak
>> but I'm interested if anyone else has thoughts or ideas about
>> how better to do this (or even not to do this).
>
> If we can leverage common code between the plugin and vsprintf.c, it
> should be doable. I haven't looked at processing format strings at
> all, though I assume the plugin would need to check the
> __printf-generated attributes.
>

smatch already does type checking of the kernel's %p extensions, plus
some additional sanity checks (e.g. passing a signed char to %02x,
duplicate KERN_* or KERN_* prefixes not at the beginning, 0x%d,
etc.). Maybe Dan Carpenter is the only one actually running it
periodically. I never managed to get sparse to grok the printf
attribute, so it uses a hardcoded list of printf-like functions. It
would be nice to do these checks in a gcc plugin to get wider coverage
and piggyback on the actual printf attributes, and it would probably be
easier to keep up with the endless stream of new %pX stuff that way.

Rasmus