linux-kernel - Re: trace_printk() broken wrt %pV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20141009113111.0ecb175d@gandalf.local.home>
Date:	Thu, 9 Oct 2014 11:31:11 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Richard Weinberger <richard.weinberger@...il.com>
Cc:	LKML <linux-kernel@...r.kernel.org>
Subject: Re: trace_printk() broken wrt %pV

On Thu, 9 Oct 2014 11:01:39 +0200
Richard Weinberger <richard.weinberger@...il.com> wrote:

> Hi Steven,
> 
> my code does something like:
> 
> void my_printf(const char *fmt, ...)
> {
>         struct va_format vaf;
>         va_list args;
> 
>         va_start(args, fmt);
>         vaf.fmt = fmt;
>         vaf.va = &args;
>         trace_printk("%pV", &vaf);
>         va_end(args);
> }
> 
> While reading from /sys/kernel/debug/tracing/trace a kernel oops happens.
> 
> [   54.406617] BUG: unable to handle kernel paging request at ffffffffffffffff

Yep, and as the doctor, I say "don't do that!" ;-)

There's a trace_vprintk(). It has an extra "ip" argument. Just put in
_THIS_IP_, for that parameter.

The reason is, trace_printk() on something like that will magically
convert to a trace_bprintk(), that stores the format and parameters on
the buffer and doesn't do the processing of the format until it needs
to be printed (read from the trace file).

In your case, it saved the format "%pV" and the address of the
va_format vaf. Then when you read from the trace file, it used the
address of the vaf to process the "%pV", and obviously at that time it
no longer is valid. It was a pointer to some stack address from the
past, and thus boom!

Use the trace_vprintk(), it will do the format processing at time of
recording, and lets you get rid of the need of using va_format.

-- Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/