linux-kernel - Re: [PATCH 1/6] serial: sh-sci: Reveal ptrval in dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 6 May 2019 15:47:05 +0200
From:   Simon Horman <horms@...ge.net.au>
To:     Eugeniu Rosca <roscaeugeniu@...il.com>
Cc:     Geert Uytterhoeven <geert+renesas@...der.be>,
        Chris Brandt <chris.brandt@...esas.com>,
        Wolfram Sang <wsa+renesas@...g-engineering.com>,
        Ulrich Hecht <ulrich.hecht+renesas@...il.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "George G . Davis" <george_davis@...tor.com>,
        Andy Lowe <andy_lowe@...tor.com>,
        linux-renesas-soc@...r.kernel.org, devicetree@...r.kernel.org,
        linux-kernel@...r.kernel.org, Magnus Damm <magnus.damm@...il.com>,
        Rob Herring <robh+dt@...nel.org>,
        Mark Rutland <mark.rutland@....com>,
        Eugeniu Rosca <erosca@...adit-jv.com>
Subject: Re: [PATCH 1/6] serial: sh-sci: Reveal ptrval in dev_dbg

On Sat, May 04, 2019 at 02:42:53AM +0200, Eugeniu Rosca wrote:
> Starting with v4.15-rc2 commit ad67b74d2469d9 ("printk: hash addresses
> printed with %p"), enabling debug prints in sh-sci.c would generate
> output like below confusing the users who try to sneak into the
> internals of the driver:
> 
> sh-sci e6e88000.serial: sci_request_dma: TX: got channel (____ptrval____)
> sh-sci e6e88000.serial: sci_request_dma: mapped 4096@(____ptrval____) to 0x00000006798bf000
> sh-sci e6e88000.serial: sci_request_dma: RX: got channel (____ptrval____)
> sh-sci e6e88000.serial: sci_dma_tx_work_fn: (____ptrval____): 0...2, cookie 2
> 
> There are two possible fixes for that:
>  - get rid of '%p' prints if they don't reveal any useful information
>  - s/%p/%px/, since it is unlikely we have any concerns leaking the
>    pointer values when running a debug/non-production kernel

I am concerned that this may expose information in circumstances
where it is undesirable. Is it generally accepted practice to
use %px in conjunction with dev_dbg() ?

...