From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59AB5C433E6 for ; Wed, 10 Feb 2021 13:41:48 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id C828B64E35 for ; Wed, 10 Feb 2021 13:41:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C828B64E35 Authentication-Results: mail.kernel.org; dmarc=fail (p=quarantine dis=none) header.from=suse.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 40C1C6B0074; Wed, 10 Feb 2021 08:41:47 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 3E2966B0075; Wed, 10 Feb 2021 08:41:47 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2F8506B0078; Wed, 10 Feb 2021 08:41:47 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0064.hostedemail.com [216.40.44.64]) by kanga.kvack.org (Postfix) with ESMTP id 194C86B0074 for ; Wed, 10 Feb 2021 08:41:47 -0500 (EST) Received: from smtpin19.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id C8F12186754FB for ; Wed, 10 Feb 2021 13:41:46 +0000 (UTC) X-FDA: 77802471012.19.light19_511347b27610 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin19.hostedemail.com (Postfix) with ESMTP id 97B371AD8CA for ; Wed, 10 Feb 2021 13:41:46 +0000 (UTC) X-HE-Tag: light19_511347b27610 X-Filterd-Recvd-Size: 8063 Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) by imf35.hostedemail.com (Postfix) with ESMTP for ; Wed, 10 Feb 2021 13:41:45 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1612964504; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=TZh1P7BD4ZXrW/ZkNSKyIjszVIwqC1RSuRGUuL4xAE8=; b=cdXuXkt+s3WOCkEhU4aTas4r3JPYiekiaW2saKAvRXZ0HCDVour6/vILKAyXncoZX9oWdW 0EJHkST7ZzRdJzOzu6q2P5VXx9sfvyqEmhdE6M/InDGLWmrBP88Z44PQ5SYfCSX+xq6Edm jEuF9sQC5g15ESlO7dZLA9XhptnqZvo= Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id AF6E4AC97; Wed, 10 Feb 2021 13:41:44 +0000 (UTC) Date: Wed, 10 Feb 2021 14:41:43 +0100 From: Petr Mladek To: Timur Tabi Cc: Steven Rostedt , Sergey Senozhatsky , Vlastimil Babka , Andy Shevchenko , Matthew Wilcox , akpm@linux-foundation.org, Linus Torvalds , roman.fietze@magna.com, Kees Cook , John Ogness , akinobu.mita@gmail.com, glider@google.com, Andrey Konovalov , Marco Elver , Rasmus Villemoes , Pavel Machek , linux-kernel@vger.kernel.org, linux-mm@kvack.org Subject: Re: [PATCH 3/3] lib/vsprintf: make-printk-non-secret printks all addresses as unhashed Message-ID: References: <20210210051814.845713-1-timur@kernel.org> <20210210051814.845713-4-timur@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210210051814.845713-4-timur@kernel.org> X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue 2021-02-09 23:18:14, Timur Tabi wrote: > If the make-printk-non-secret command line parameter is set, then > printk("%p") will print pointers as unhashed. This is useful for > debugging purposes. > > A large warning message is displayed if this option is enabled. > Unhashed pointers, while useful for debugging, expose kernel > addresses which can be a security risk. > > Also update test_printf to skip the hashed pointer tests if the > command-line option is set. > > Signed-off-by: Timur Tabi > Acked-by: Petr Mladek > Acked-by: Randy Dunlap > Acked-by: Sergey Senozhatsky > --- > .../admin-guide/kernel-parameters.txt | 15 ++++++++ > lib/test_printf.c | 8 ++++ > lib/vsprintf.c | 38 ++++++++++++++++++- > 3 files changed, 59 insertions(+), 2 deletions(-) > > diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt > index a10b545c2070..6962379469e4 100644 > --- a/Documentation/admin-guide/kernel-parameters.txt > +++ b/Documentation/admin-guide/kernel-parameters.txt > @@ -2613,6 +2613,21 @@ > different yeeloong laptops. > Example: machtype=lemote-yeeloong-2f-7inch > > + make-printk-non-secret > + Force pointers printed to the console to be unhashed. > + By default, when a pointer is printed to the kernel > + console (via %p format string), that pointer is > + "hashed", i.e. obscured by hashing the pointer value. > + This is a security feature that hides actual kernel > + addresses from unprivileged users, but it also makes > + debugging the kernel more difficult since unequal > + pointers can no longer be compared. If this option is > + specified, then all normal pointers will have their > + true value printed. Pointers printed via %pK may > + still be hashed. This option should only be specified > + when debugging the kernel. Please do not use on > + production kernels. > + > max_addr=nn[KMG] [KNL,BOOT,ia64] All physical memory greater > than or equal to this physical address is ignored. > > diff --git a/lib/test_printf.c b/lib/test_printf.c > index ad2bcfa8caa1..b0b62d76e598 100644 > --- a/lib/test_printf.c > +++ b/lib/test_printf.c > @@ -35,6 +35,8 @@ KSTM_MODULE_GLOBALS(); > static char *test_buffer __initdata; > static char *alloced_buffer __initdata; > > +extern bool debug_never_hash_pointers; > + > static int __printf(4, 0) __init > do_test(int bufsize, const char *expect, int elen, > const char *fmt, va_list ap) > @@ -301,6 +303,12 @@ plain(void) > { > int err; > > + if (debug_never_hash_pointers) { > + pr_warn("skipping plain 'p' tests"); > + skipped_tests += 2; > + return; > + } > + > err = plain_hash(); > if (err) { > pr_warn("plain 'p' does not appear to be hashed\n"); > diff --git a/lib/vsprintf.c b/lib/vsprintf.c > index 3b53c73580c5..1296d9b0b328 100644 > --- a/lib/vsprintf.c > +++ b/lib/vsprintf.c > @@ -2090,6 +2090,34 @@ char *fwnode_string(char *buf, char *end, struct fwnode_handle *fwnode, > return widen_string(buf, buf - buf_start, end, spec); > } > > +/* Disable pointer hashing if requested */ > +bool debug_never_hash_pointers __ro_after_init; > +EXPORT_SYMBOL_GPL(debug_never_hash_pointers); > + > +static int __init debug_never_hash_pointers_enable(char *str) > +{ > + debug_never_hash_pointers = true; > + > + pr_warn("**********************************************************\n"); > + pr_warn("** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **\n"); > + pr_warn("** **\n"); > + pr_warn("** All pointers that are printed to the console will **\n"); > + pr_warn("** be printed as unhashed. **\n"); > + pr_warn("** **\n"); > + pr_warn("** Kernel memory addresses are exposed, which may **\n"); > + pr_warn("** reduce the security of your system. **\n"); > + pr_warn("** **\n"); > + pr_warn("** If you see this message and you are not debugging **\n"); > + pr_warn("** the kernel, report this immediately to your system **\n"); > + pr_warn("** administrator! **\n"); > + pr_warn("** **\n"); > + pr_warn("** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **\n"); > + pr_warn("**********************************************************\n"); > + > + return 0; > +} > +early_param("make-printk-non-secret", debug_never_hash_pointers_enable); The mail about EFENCE, and the different names of the parameter and the variable, made realized one important thing. The kernel parameter and the message does not describe the full effect. The option causes that vsprintf() will not hash pointers. Yes, it is primary used by printk(). But it is used also in some other interfaces, especially trace_printk(), seq_buf() API. The naked pointers might appear more or less anywhere, including procfs, sysfs, debugfs. IMHO, we should fix this. The long discussion was about how to make this option safe. Users should be aware that it is not only about the kernel log. I suggest to rename the parameter "debug_never_hash_pointer" and use the same name for the parameter and the variable. We also should make the warning more generic. I suggest to replace the first paragraph with something like: pr_warn("** The hashing of printed pointers has been disabled **\n"); pr_warn("** for debugging purposes. **\n"); Feel free to use a better wording. I am not a native speaker. Of course, also kernel-parameters.txt has to be updated accordingly. Best Regards, Petr