From: Helge Deller <deller@gmx.de>
To: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Cc: linux-kernel@vger.kernel.org,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Petr Mladek <pmladek@suse.com>,
Andrew Morton <akpm@linux-foundation.org>
Subject: Re: [PATCH 00/14] Fix wrong %pF and %pS printk format specifier usages
Date: Thu, 7 Sep 2017 11:12:21 +0200 [thread overview]
Message-ID: <667b8849-fb60-a312-2483-505252ff737e@gmx.de> (raw)
In-Reply-To: <20170907083207.GC533@jagdpanzerIV.localdomain>
On 07.09.2017 10:32, Sergey Senozhatsky wrote:
> On (09/07/17 16:56), Sergey Senozhatsky wrote:
> [..]
> probe_kernel_address() handles the page fault and returns -EFAULT if
> you give it bad pointer. module_address_lookup() and get_symbol_pos()
> seems to be smart enough not to crash on bad pointer as well. what am
> I missing? could you please explain where we will crash?
Actually I never faced a kernel crash because of this on parisc.
Don't know for ia64 and ppc64.
>> BTW, are we sure we can crash? when attempt to deference IP from
>> the given descriptor? shall we handle page fault in this case and
>> do something sane? just asking.
>
> I don't know... does the below code make any sense?
No. Read below.
> basically it checks that it's safe to access ptr (we can access it
> without page fault in __dereference_function_descriptor()). then
> we do ptr->ip, and also check if it's safe, but in
> dereference_function_descriptor().
>
> I suppose somethign like
>
> pr_err("%pF\n", 1);
>
> can crash ia64, etc. correct?
On parisc it will not crash because we handle that one already.
For others I don't know.
But something like
pr_err("%pF\n", (unsigned long) (-1));
or any address above 0xffffffff00000000ULL might do bad things
on parisc, because it touches the I/O space and we don't check that yet.
> lib/vsprintf.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> index 86c3385b9eb3..0dc39b95e1d9 100644
> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -1593,6 +1593,16 @@ char *device_node_string(char *buf, char *end, struct device_node *dn,
>
> int kptr_restrict __read_mostly;
>
> +static void *__dereference_function_descriptor(void *ptr)
> +{
> + void *p;
> +
> + if (!probe_kernel_address(ptr, p))
> + return dereference_function_descriptor(ptr);
> +
> + return ptr;
> +}
> +
> /*
> * Show a '%p' thing. A kernel extension is that the '%p' is followed
> * by an extra set of alphanumeric characters that are extended format
> @@ -1723,7 +1733,7 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
> switch (*fmt) {
> case 'F':
> case 'f':
> - ptr = dereference_function_descriptor(ptr);
> + ptr = __dereference_function_descriptor(ptr);
This is not needed.
All affected arches (ia64, ppc64, parisc64) already call
probe_kernel_address() inside their dereference_function_descriptor() function.
So this patch just adds unnecessary overhead for all arches.
> ... here is a question, does function descriptor belong to a special
> section? can we check that supplied ptr belongs to a descriptor section
> and avoid dereference_function_descriptor() if it doesn't? (just fall
> through directly to symbol_string() in this case). is this possible?
I think theoretically yes.
On parisc ptr does *not* point to any code segment, and most likely it
points to the .data segment. I don't know if that's the case for ia64 and
ppc64 too.
I can look into adding such check-code, but even then the warning will
only show up if you run on ia64, ppc64 and parisc64.
Helge
next prev parent reply other threads:[~2017-09-07 9:12 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-06 20:27 [PATCH 00/14] Fix wrong %pF and %pS printk format specifier usages Helge Deller
2017-09-06 20:27 ` [PATCH 01/14] arm: Use %pS printk format for symbols from direct addresses Helge Deller
2017-09-06 20:27 ` [PATCH 02/14] um: " Helge Deller
2017-09-12 12:10 ` Petr Mladek
2017-09-21 20:13 ` Richard Weinberger
2017-09-06 20:27 ` [PATCH 03/14] x86: " Helge Deller
2017-09-06 20:27 ` [PATCH 04/14] ti_sci: Use %pS printk format for " Helge Deller
2017-09-08 23:30 ` Nishanth Menon
2017-09-09 0:30 ` Santosh Shilimkar
2017-09-06 20:27 ` [PATCH 05/14] i915: " Helge Deller
2017-09-27 12:24 ` [Intel-gfx] " Daniel Vetter
2017-09-06 20:27 ` [PATCH 06/14] md/bcache: " Helge Deller
2017-09-07 4:50 ` Coly Li
2017-09-07 7:42 ` Helge Deller
2017-09-07 7:49 ` Coly Li
2017-09-07 8:05 ` Sergey Senozhatsky
2017-09-06 20:27 ` [PATCH 07/14] power/avs: " Helge Deller
2017-09-08 23:37 ` Nishanth Menon
2017-09-06 20:27 ` [PATCH 08/14] fs/f2fs: " Helge Deller
2017-09-06 20:27 ` [PATCH 09/14] fs/pstore: " Helge Deller
2018-11-29 23:26 ` Kees Cook
2018-11-29 23:49 ` Luck, Tony
2018-11-30 0:40 ` Kees Cook
2017-09-06 20:27 ` [PATCH 10/14] fs/xfs: " Helge Deller
2017-09-08 7:38 ` Christoph Hellwig
2017-09-18 18:37 ` Darrick J. Wong
2017-09-06 20:27 ` [PATCH 11/14] smp: Use %pF printk format specifier for function pointers Helge Deller
2017-09-06 20:27 ` [PATCH 12/14] mm/memblock: Use %pS printk format for direct addresses Helge Deller
2017-09-06 20:28 ` [PATCH 13/14] netfilter/ipvs: " Helge Deller
2017-10-09 5:52 ` Simon Horman
2017-11-06 13:46 ` Pablo Neira Ayuso
2017-09-06 20:28 ` [PATCH 14/14] sound/core: " Helge Deller
2017-09-07 8:36 ` Takashi Iwai
2017-09-07 0:45 ` [PATCH 00/14] Fix wrong %pF and %pS printk format specifier usages Sergey Senozhatsky
2017-09-07 6:01 ` Helge Deller
2017-09-07 7:56 ` Sergey Senozhatsky
2017-09-07 8:32 ` Sergey Senozhatsky
2017-09-07 9:12 ` Helge Deller [this message]
2017-09-07 9:36 ` Sergey Senozhatsky
2017-09-07 9:51 ` Sergey Senozhatsky
2017-09-07 12:38 ` Helge Deller
2017-09-07 16:05 ` Luck, Tony
2017-09-08 6:18 ` Sergey Senozhatsky
2017-09-08 17:25 ` Luck, Tony
2017-09-08 18:28 ` Helge Deller
2017-09-14 7:40 ` Sergey Senozhatsky
2017-09-14 8:03 ` Sergey Senozhatsky
2017-09-14 8:39 ` Helge Deller
2017-09-14 9:27 ` Sergey Senozhatsky
2017-09-14 9:47 ` Helge Deller
2017-09-14 16:01 ` Luck, Tony
2017-09-18 7:03 ` Sergey Senozhatsky
2017-09-14 6:53 ` Sergey Senozhatsky
2017-09-08 20:49 ` Helge Deller
2017-09-12 11:18 ` Petr Mladek
2017-09-14 6:44 ` Sergey Senozhatsky
2017-09-08 22:23 ` Yu, Fenghua
2017-09-14 6:35 ` Sergey Senozhatsky
2017-09-07 16:50 ` Joe Perches
2017-09-08 6:23 ` Sergey Senozhatsky
2017-09-08 20:39 ` Helge Deller
2017-09-12 12:23 ` Petr Mladek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=667b8849-fb60-a312-2483-505252ff737e@gmx.de \
--to=deller@gmx.de \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pmladek@suse.com \
--cc=sergey.senozhatsky.work@gmail.com \
--cc=sergey.senozhatsky@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).