linux-kernel - Re: [PATCH 00/14] Fix wrong %pF and %pS printk format specifier usages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 14 Sep 2017 16:40:44 +0900
From:   Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>
To:     Helge Deller <deller@....de>
Cc:     "Luck, Tony" <tony.luck@...el.com>,
        Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Petr Mladek <pmladek@...e.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "Yu, Fenghua" <fenghua.yu@...el.com>,
        Benjamin Herrenschmidt <benh@...nel.crashing.org>,
        Paul Mackerras <paulus@...ba.org>,
        Michael Ellerman <mpe@...erman.id.au>
Subject: Re: [PATCH 00/14] Fix wrong %pF and %pS printk format specifier
 usages

On (09/08/17 20:28), Helge Deller wrote:
[..]
> I don't like this kind of trying to figure out at runtime at all.
> It's too much guessing in here IMHO.

well, may be we can avoid any guessing by checking that the
pointer belongs to .opd section.

for kernel we can add 2 new unsigned longs - __opd_start __opd_end -- and
tweak the corresponding arch/${FOO}/kernel/vmlinux.lds.S file to set those
two, the same way text, unwinding, etc. are set.

.... wait a second.

arch/ia64/kernel/vmlinux.lds.S  already handles .opd section

	.opd : AT(ADDR(.opd) - LOAD_OFFSET) {
		*(.opd)
	}

it just doesn't save start/end addresses. so all we need to to
is

        .opd : AT(ADDR(.opd) - LOAD_OFFSET) {
+               __opd_start = .;
                *(.opd)
+               __opd_end = .;
        }

and tweak symbol dereference

 static inline void *dereference_function_descriptor(void *ptr)
 {
        struct fdesc *desc = ptr;
        void *p;
 
+       if (prt < (void *)__start_opd || (void *)__end_opd < ptr)
+               return ptr;
+
        if (!probe_kernel_address(&desc->ip, p))
                ptr = p;
        return ptr;



now, the modules.

module_frob_arch_sections() has the following lines

	else if (strcmp(".opd", secstrings + s->sh_name) == 0)
		mod->arch.opd = s;

so, once, again, we keep the .opd section info in memory. and we
also have the size of that section

	mod->arch.opd->sh_size = fdescs * sizeof(struct fdesc);

so it seems that we've got what we need. need to provide arch callback
(same way as we do with dereference_function_descriptor() to properly
dereference modules' symbols).


so I think we almost have what we need to make ps/pS smart enough
on ppc64/ia64/parisc.

powerpc and parisc handle kernel .opd section as well:

arch/powerpc/kernel/vmlinux.lds.S:      .opd
arch/parisc/kernel/vmlinux.lds.S:       .opd


need to check more.


> What about this idea:
> For %pF we always have pointers to functions, e.g.: 
>         printk("Going to call: %pF\n", gettimeofday);
>         printk("Going to call: %pF\n", p->func);
> 
> and for %pS most (if not all) usages use some kind of casting 
> from "unsigned long" to "void *", e.g.:
>         printk("%s: called from %pS\n", __func__, (void *)_RET_IP_);
>         printk("%s: called from %pS\n", __func__, (void *)__builtin_return_address(0));
>         printk("Faulted at %pS\n", (void *)regs->ip);
> 
> So, what if we for the %pS case simply take the type as it is 
> (unsigned long) and introduce a new printk-format, e.g. "%luS" ?
> The %pS examples above then become:
>         printk("%s: called from %luS\n", __func__, _RET_IP_);
>         printk("%s: called from %luS\n", __func__, __builtin_return_address(0));
>         printk("Faulted at %luS\n", regs->ip);
> 
> That way we don't need type-casting, gain compile-time type 
> checks from the compiler, and we could add a checkpatch (or occinelle)
> check which checks for the combination of %pF/%pS and "void*" keyword
> and suggest to use %luS.
> 
> Opinions?

hm. sounds interesting. but I'm afraid people won't be so happy
to learn a new printk format specifier.

	-ss