[PATCH v3 1/1] vsprintf: protect kernel from panic due to non-canonical pointer dereference

From: Jane Chu <jane.chu@oracle.com>
To: pmladek@suse.com, rostedt@goodmis.org, senozhatsky@chromium.org,
	andriy.shevchenko@linux.intel.com, linux@rasmusvillemoes.dk,
	linux-mm@kvack.org, linux-kernel@vger.kernel.org
Cc: wangkefeng.wang@huawei.com, konrad.wilk@oracle.com,
	haakon.bugge@oracle.com, john.haxby@oracle.com,
	jane.chu@oracle.com
Subject: [PATCH v3 1/1] vsprintf: protect kernel from panic due to non-canonical pointer dereference
Date: Wed, 19 Oct 2022 13:34:31 -0600	[thread overview]
Message-ID: <20221019193431.2923462-2-jane.chu@oracle.com> (raw)
In-Reply-To: <20221019193431.2923462-1-jane.chu@oracle.com>

Having stepped on a local kernel bug where reading sysfs has led to
out-of-bound pointer dereference by vsprintf() which led to GPF panic.
And the reason for GPF is that the OOB pointer was turned to a
non-canonical address such as 0x7665645f63616465.

vsprintf() already has this line of defense
	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
                return "(efault)";
Since a non-canonical pointer can be detected by kern_addr_valid()
on architectures that present VM holes as well as meaningful
implementation of kern_addr_valid() that detects the non-canonical
addresses, this patch addes a check on non-canonical string pointer by
kern_addr_valid() and display "(efault)" to alert user that something
is wrong instead of unecessarily panic the server.

On the other hand, if the non-canonical string pointer is dereferenced
else where in the kernel, by virtue of being non-canonical, a crash
is expected to be immediate.

Signed-off-by: Jane Chu <jane.chu@oracle.com>
---
 lib/vsprintf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index c414a8d9f1ea..b38c12ef1e45 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -698,6 +698,9 @@ static const char *check_pointer_msg(const void *ptr)
 	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
 		return "(efault)";
 
+	if (!kern_addr_valid((unsigned long)ptr))
+		return "(efault)";
+
 	return NULL;
 }
 
-- 
2.18.4

