lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 09 Sep 2017 22:47:39 +0100 From: Ben Hutchings <ben@...adent.org.uk> To: linux-kernel@...r.kernel.org, stable@...r.kernel.org CC: akpm@...ux-foundation.org, "Vamsi Krishna Samavedam" <vskrishn@...eaurora.org>, "Greg Kroah-Hartman" <gregkh@...uxfoundation.org> Subject: [PATCH 3.2 012/106] USB: core: replace %p with %pK 3.2.93-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Vamsi Krishna Samavedam <vskrishn@...eaurora.org> commit 2f964780c03b73de269b08d12aff96a9618d13f3 upstream. Format specifier %p can leak kernel addresses while not valuing the kptr_restrict system settings. When kptr_restrict is set to (1), kernel pointers printed using the %pK format specifier will be replaced with Zeros. Debugging Note : &pK prints only Zeros as address. If you need actual address information, write 0 to kptr_restrict. echo 0 > /proc/sys/kernel/kptr_restrict [Found by poking around in a random vendor kernel tree, it would be nice if someone would actually send these types of patches upstream - gkh] Signed-off-by: Vamsi Krishna Samavedam <vskrishn@...eaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org> [bwh: Backported to 3.2: drop changes in proc_reapurb*(), usbdev_do_ioctl(), usb_submit_urb()] Signed-off-by: Ben Hutchings <ben@...adent.org.uk> --- --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -325,11 +325,11 @@ static void snoop_urb(struct usb_device if (userurb) { /* Async */ if (when == SUBMIT) - dev_info(&udev->dev, "userurb %p, ep%d %s-%s, " + dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " "length %u\n", userurb, ep, t, d, length); else - dev_info(&udev->dev, "userurb %p, ep%d %s-%s, " + dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " "actual_length %u status %d\n", userurb, ep, t, d, length, timeout_or_status); --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -1563,7 +1563,7 @@ int usb_hcd_unlink_urb (struct urb *urb, if (retval == 0) retval = -EINPROGRESS; else if (retval != -EIDRM && retval != -EBUSY) - dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n", + dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n", urb, retval); usb_put_dev(udev); } @@ -1645,7 +1645,7 @@ rescan: /* kick hcd */ unlink1(hcd, urb, -ESHUTDOWN); dev_dbg (hcd->self.controller, - "shutdown urb %p ep%d%s%s\n", + "shutdown urb %pK ep%d%s%s\n", urb, usb_endpoint_num(&ep->desc), is_in ? "in" : "out", ({ char *s;
Powered by blists - more mailing lists