linux-kernel - [PATCH 0/2] tracing: Detect unsafe dereferencing of pointers from trace events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210226185909.100032746@goodmis.org>
Date:   Fri, 26 Feb 2021 13:59:09 -0500
From:   Steven Rostedt <rostedt@...dmis.org>
To:     linux-kernel@...r.kernel.org
Cc:     Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Jacob Wen <jian.w.wen@...cle.com>
Subject: [PATCH 0/2] tracing: Detect unsafe dereferencing of pointers from trace events

After seeing that an unsafe string dereference in a trace event made
it into the kernel, I decided it's time to add some sanity checks to
catch these cases without needing me to supervise.

The first patch scans the print fmts of the trace events looking for
dereferencing pointers from %p*, and making sure that they refer back
to the trace event itself.

The second patch handles strings "%s", as there are cases that are
fine with dereferencing the string outside the trace event. On reading
of the trace file, the %s is looked for and when found, the logic checks
the pointer that it is about to be dereferenced to see if it is a
valid location. This check would have caught the last unsafe dereference
committed into the kernel.

Steven Rostedt (VMware) (2):
      tracing: Add check of trace event print fmts for dereferencing pointers
      tracing: Add a verifier to check string pointers for trace events

----
 kernel/trace/trace.c        | 148 +++++++++++++++++++++++++++++++++
 kernel/trace/trace.h        |   2 +
 kernel/trace/trace_events.c | 198 ++++++++++++++++++++++++++++++++++++++++++++
 kernel/trace/trace_output.c |   2 +-
 4 files changed, 349 insertions(+), 1 deletion(-)