linux-kernel - Re: [PATCH] powerpc:Don't print raw EIP/LR hex values in dump_stack() and show

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <57a31937-9332-f05b-9200-b071e2fee132@csgroup.eu>
Date:   Tue, 22 Dec 2020 18:45:50 +0100
From:   Christophe Leroy <christophe.leroy@...roup.eu>
To:     Segher Boessenkool <segher@...nel.crashing.org>,
        Xiaoming Ni <nixiaoming@...wei.com>
Cc:     David Laight <David.Laight@...lab.com>,
        "ravi.bangoria@...ux.ibm.com" <ravi.bangoria@...ux.ibm.com>,
        "mikey@...ling.org" <mikey@...ling.org>,
        "yanaijie@...wei.com" <yanaijie@...wei.com>,
        "haren@...ux.ibm.com" <haren@...ux.ibm.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "npiggin@...il.com" <npiggin@...il.com>,
        "wangle6@...wei.com" <wangle6@...wei.com>,
        "paulus@...ba.org" <paulus@...ba.org>,
        "aneesh.kumar@...ux.ibm.com" <aneesh.kumar@...ux.ibm.com>,
        "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>
Subject: Re: [PATCH] powerpc:Don't print raw EIP/LR hex values in dump_stack()
 and show_regs()



Le 22/12/2020 à 18:29, Segher Boessenkool a écrit :
> On Tue, Dec 22, 2020 at 09:45:03PM +0800, Xiaoming Ni wrote:
>> On 2020/12/22 1:12, Segher Boessenkool wrote:
>>> On Mon, Dec 21, 2020 at 04:42:23PM +0000, David Laight wrote:
>>>> From: Segher Boessenkool
>>>>> Sent: 21 December 2020 16:32
>>>>>
>>>>> On Mon, Dec 21, 2020 at 04:17:21PM +0100, Christophe Leroy wrote:
>>>>>> Le 21/12/2020 à 04:27, Xiaoming Ni a écrit :
>>>>>>> Since the commit 2b0e86cc5de6 ("powerpc/fsl_booke/32: implement KASLR
>>>>>>> infrastructure"), the powerpc system is ready to support KASLR.
>>>>>>> To reduces the risk of invalidating address randomization, don't print
>>>>>>> the
>>>>>>> EIP/LR hex values in dump_stack() and show_regs().
>>>>>
>>>>>> I think your change is not enough to hide EIP address, see below a dump
>>>>>> with you patch, you get "Faulting instruction address: 0xc03a0c14"
>>>>>
>>>>> As far as I can see the patch does nothing to the GPR printout.  Often
>>>>> GPRs contain code addresses.  As one example, the LR is moved via a GPR
>>>>> (often GPR0, but not always) for storing on the stack.
>>>>>
>>>>> So this needs more work.
>>>>
>>>> If the dump_stack() is from an oops you need the real EIP value
>>>> on order to stand any chance of making headway.
>>>
>>> Or at least the function name + offset, yes.
>>>
>> When the system is healthy, only symbols and offsets are printed,
>> Output address and symbol + offset when the system is dying
>> Does this meet both debugging and security requirements?
> 
> If you have the vmlinux, sym+off is enough to find what instruction
> caused the crash.
> 
> It does of course not give all the information you get in a crash dump
> with all the registers, so it does hinder debugging a bit.  This is a
> tradeoff.
> 
> Most debugging will need xmon or similar (or printf-style debugging)
> anyway; and otoh the register dump will render KASLR largely
> ineffective.
> 
>> For example:
>>
>> +static void __show_regs_ip_lr(const char *flag, unsigned long addr)
>> +{
>> + if (system_going_down()) { /* panic oops reboot */
>> +         pr_cont("%s["REG"] %pS", flag, addr, (void *)addr);
>> + } else {
>> +         pr_cont("%s%pS", flag, (void *)addr);
>> + }
>> +}
> 
> *If* you are certain the system goes down immediately, and you are also
> certain this information will not help defeat ASLR after a reboot, you
> could just print whatever, sure.
> 
> Otherwise, you only want to show some very few registers.  Or, make sure
> no attackers can ever see these dumps (which is hard, many systems trust
> all (local) users with it!)  Which means we first will need some very
> different patches, before any of this can be much useful :-(
> 

So IIUC, on one side we enlarge the dumping of registers with commits like 
https://github.com/linuxppc/linux/commit/bf13718bc57ada25016d9fe80323238d0b94506e#diff-8b965e0e62fc1b6ad5e51bf0a539941e929754cdb716041b06b4f4a5f73590f9, 
and on the other side we want to narrow it and hide registers ? I'm lost.

Christophe