[PATCH] vsprintf: protect kernel from panic due to non-canonical pointer dereference

From: Jane Chu <jane.chu@oracle.com>
To: pmladek@suse.com, rostedt@goodmis.org, senozhatsky@chromium.org,
	andriy.shevchenko@linux.intel.com, linux@rasmusvillemoes.dk,
	linux-kernel@vger.kernel.org
Cc: jane.chu@oracle.com
Subject: [PATCH] vsprintf: protect kernel from panic due to non-canonical pointer dereference
Date: Mon, 17 Oct 2022 13:16:11 -0600	[thread overview]
Message-ID: <20221017191611.2577466-1-jane.chu@oracle.com> (raw)

While debugging a separate issue, it was found that an invalid string
pointer could very well contain a non-canical address, such as
0x7665645f63616465. In that case, this line of defense isn't enough
to protect the kernel from crashing due to general protection fault

	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
                return "(efault)";

So instead, use kern_addr_valid() to validate the string pointer.

Signed-off-by: Jane Chu <jane.chu@oracle.com>
---
 lib/vsprintf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index c414a8d9f1ea..2e8a9efc7c12 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -695,7 +695,7 @@ static const char *check_pointer_msg(const void *ptr)
 	if (!ptr)
 		return "(null)";
 
-	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
+	if (!kern_addr_valid((unsigned long)ptr))
 		return "(efault)";
 
 	return NULL;
-- 
2.18.4

