From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.5 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2DF7C433E0 for ; Wed, 10 Feb 2021 11:03:30 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id C210B64E37 for ; Wed, 10 Feb 2021 11:03:29 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C210B64E37 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.cz Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id EAB366B0006; Wed, 10 Feb 2021 06:03:28 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E5AC96B006C; Wed, 10 Feb 2021 06:03:28 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D71996B006E; Wed, 10 Feb 2021 06:03:28 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0027.hostedemail.com [216.40.44.27]) by kanga.kvack.org (Postfix) with ESMTP id C2B706B0006 for ; Wed, 10 Feb 2021 06:03:28 -0500 (EST) Received: from smtpin29.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 8723E1265B for ; Wed, 10 Feb 2021 11:03:28 +0000 (UTC) X-FDA: 77802072096.29.9D7C4C9 Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) by imf24.hostedemail.com (Postfix) with ESMTP id 87018A0000FC for ; Wed, 10 Feb 2021 11:03:27 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 8FEE1AD29; Wed, 10 Feb 2021 11:03:26 +0000 (UTC) Subject: Re: [PATCH 3/3] lib/vsprintf: make-printk-non-secret printks all addresses as unhashed To: Timur Tabi , Petr Mladek , Steven Rostedt , Sergey Senozhatsky , Andy Shevchenko , Matthew Wilcox , akpm@linux-foundation.org, Linus Torvalds , roman.fietze@magna.com, Kees Cook , John Ogness , akinobu.mita@gmail.com, glider@google.com, Andrey Konovalov , Marco Elver , Rasmus Villemoes , Pavel Machek , linux-kernel@vger.kernel.org, linux-mm@kvack.org References: <20210210051814.845713-1-timur@kernel.org> <20210210051814.845713-4-timur@kernel.org> From: Vlastimil Babka Message-ID: <9c6ed37a-aeae-7816-d204-ff752a05efdd@suse.cz> Date: Wed, 10 Feb 2021 12:03:25 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.7.0 MIME-Version: 1.0 In-Reply-To: <20210210051814.845713-4-timur@kernel.org> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 87018A0000FC X-Stat-Signature: cczbmf1dyaje81jxrrpgw4daa7sjj1q8 Received-SPF: none (suse.cz>: No applicable sender policy available) receiver=imf24; identity=mailfrom; envelope-from=""; helo=mx2.suse.de; client-ip=195.135.220.15 X-HE-DKIM-Result: none/none X-HE-Tag: 1612955007-413539 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 2/10/21 6:18 AM, Timur Tabi wrote: > If the make-printk-non-secret command line parameter is set, then > printk("%p") will print pointers as unhashed. This is useful for > debugging purposes. > > A large warning message is displayed if this option is enabled. > Unhashed pointers, while useful for debugging, expose kernel > addresses which can be a security risk. > > Also update test_printf to skip the hashed pointer tests if the > command-line option is set. > > Signed-off-by: Timur Tabi > Acked-by: Petr Mladek > Acked-by: Randy Dunlap > Acked-by: Sergey Senozhatsky Acked-by: Vlastimil Babka Thanks! > --- > .../admin-guide/kernel-parameters.txt | 15 ++++++++ > lib/test_printf.c | 8 ++++ > lib/vsprintf.c | 38 ++++++++++++++++++- > 3 files changed, 59 insertions(+), 2 deletions(-) > > diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt > index a10b545c2070..6962379469e4 100644 > --- a/Documentation/admin-guide/kernel-parameters.txt > +++ b/Documentation/admin-guide/kernel-parameters.txt > @@ -2613,6 +2613,21 @@ > different yeeloong laptops. > Example: machtype=lemote-yeeloong-2f-7inch > > + make-printk-non-secret > + Force pointers printed to the console to be unhashed. > + By default, when a pointer is printed to the kernel > + console (via %p format string), that pointer is > + "hashed", i.e. obscured by hashing the pointer value. > + This is a security feature that hides actual kernel > + addresses from unprivileged users, but it also makes > + debugging the kernel more difficult since unequal > + pointers can no longer be compared. If this option is > + specified, then all normal pointers will have their > + true value printed. Pointers printed via %pK may > + still be hashed. This option should only be specified > + when debugging the kernel. Please do not use on > + production kernels. > + > max_addr=nn[KMG] [KNL,BOOT,ia64] All physical memory greater > than or equal to this physical address is ignored. > > diff --git a/lib/test_printf.c b/lib/test_printf.c > index ad2bcfa8caa1..b0b62d76e598 100644 > --- a/lib/test_printf.c > +++ b/lib/test_printf.c > @@ -35,6 +35,8 @@ KSTM_MODULE_GLOBALS(); > static char *test_buffer __initdata; > static char *alloced_buffer __initdata; > > +extern bool debug_never_hash_pointers; > + > static int __printf(4, 0) __init > do_test(int bufsize, const char *expect, int elen, > const char *fmt, va_list ap) > @@ -301,6 +303,12 @@ plain(void) > { > int err; > > + if (debug_never_hash_pointers) { > + pr_warn("skipping plain 'p' tests"); > + skipped_tests += 2; > + return; > + } > + > err = plain_hash(); > if (err) { > pr_warn("plain 'p' does not appear to be hashed\n"); > diff --git a/lib/vsprintf.c b/lib/vsprintf.c > index 3b53c73580c5..1296d9b0b328 100644 > --- a/lib/vsprintf.c > +++ b/lib/vsprintf.c > @@ -2090,6 +2090,34 @@ char *fwnode_string(char *buf, char *end, struct fwnode_handle *fwnode, > return widen_string(buf, buf - buf_start, end, spec); > } > > +/* Disable pointer hashing if requested */ > +bool debug_never_hash_pointers __ro_after_init; > +EXPORT_SYMBOL_GPL(debug_never_hash_pointers); > + > +static int __init debug_never_hash_pointers_enable(char *str) > +{ > + debug_never_hash_pointers = true; > + > + pr_warn("**********************************************************\n"); > + pr_warn("** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **\n"); > + pr_warn("** **\n"); > + pr_warn("** All pointers that are printed to the console will **\n"); > + pr_warn("** be printed as unhashed. **\n"); > + pr_warn("** **\n"); > + pr_warn("** Kernel memory addresses are exposed, which may **\n"); > + pr_warn("** reduce the security of your system. **\n"); > + pr_warn("** **\n"); > + pr_warn("** If you see this message and you are not debugging **\n"); > + pr_warn("** the kernel, report this immediately to your system **\n"); > + pr_warn("** administrator! **\n"); > + pr_warn("** **\n"); > + pr_warn("** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **\n"); > + pr_warn("**********************************************************\n"); > + > + return 0; > +} > +early_param("make-printk-non-secret", debug_never_hash_pointers_enable); > + > /* > * Show a '%p' thing. A kernel extension is that the '%p' is followed > * by an extra set of alphanumeric characters that are extended format > @@ -2297,8 +2325,14 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, > } > } > > - /* default is to _not_ leak addresses, hash before printing */ > - return ptr_to_id(buf, end, ptr, spec); > + /* > + * default is to _not_ leak addresses, so hash before printing unless > + * make-printk-non-secret is specified on the command line. > + */ > + if (unlikely(debug_never_hash_pointers)) > + return pointer_string(buf, end, ptr, spec); > + else > + return ptr_to_id(buf, end, ptr, spec); > } > > /* >