linux-kernel - Re: [PATCH mm] kfence: fix printk format for ptrdiff

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c1fea2e6-4acf-1fff-07ff-1b430169f22f@csgroup.eu>
Date:   Tue, 16 Mar 2021 09:32:32 +0100
From:   Christophe Leroy <christophe.leroy@...roup.eu>
To:     Alexander Potapenko <glider@...gle.com>,
        Marco Elver <elver@...gle.com>,
        Segher Boessenkool <segher@...nel.crashing.org>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Dmitriy Vyukov <dvyukov@...gle.com>,
        Andrey Konovalov <andreyknvl@...gle.com>,
        Jann Horn <jannh@...gle.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Linux Memory Management List <linux-mm@...ck.org>,
        kasan-dev <kasan-dev@...glegroups.com>
Subject: Re: [PATCH mm] kfence: fix printk format for ptrdiff_t

+segher

Le 03/03/2021 à 13:27, Alexander Potapenko a écrit :
> On Wed, Mar 3, 2021 at 1:12 PM Marco Elver <elver@...gle.com> wrote:
>>
>> Use %td for ptrdiff_t.
>>
>> Link: https://lkml.kernel.org/r/3abbe4c9-16ad-c168-a90f-087978ccd8f7@csgroup.eu
>> Reported-by: Christophe Leroy <christophe.leroy@...roup.eu>
>> Signed-off-by: Marco Elver <elver@...gle.com>
> Reviewed-by: Alexander Potapenko <glider@...gle.com>
> 

Still a problem.

I don't understand, gcc bug ?

The offending argument is 'const ptrdiff_t object_index'

We have:

arch/powerpc/include/uapi/asm/posix_types.h:typedef long		__kernel_ptrdiff_t;
include/linux/types.h:typedef __kernel_ptrdiff_t	ptrdiff_t;

And get:

   CC      mm/kfence/report.o
In file included from ./include/linux/printk.h:7,
                  from ./include/linux/kernel.h:16,
                  from mm/kfence/report.c:10:
mm/kfence/report.c: In function 'kfence_report_error':
./include/linux/kern_levels.h:5:18: warning: format '%td' expects argument of type 'ptrdiff_t', but 
argument 6 has type 'long int' [-Wformat=]
     5 | #define KERN_SOH "\001"  /* ASCII Start Of Header */
       |                  ^~~~~~
./include/linux/kern_levels.h:11:18: note: in expansion of macro 'KERN_SOH'
    11 | #define KERN_ERR KERN_SOH "3" /* error conditions */
       |                  ^~~~~~~~
./include/linux/printk.h:343:9: note: in expansion of macro 'KERN_ERR'
   343 |  printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
       |         ^~~~~~~~
mm/kfence/report.c:213:3: note: in expansion of macro 'pr_err'
   213 |   pr_err("Out-of-bounds %s at 0x%p (%luB %s of kfence-#%td):\n",
       |   ^~~~~~
./include/linux/kern_levels.h:5:18: warning: format '%td' expects argument of type 'ptrdiff_t', but 
argument 4 has type 'long int' [-Wformat=]
     5 | #define KERN_SOH "\001"  /* ASCII Start Of Header */
       |                  ^~~~~~
./include/linux/kern_levels.h:11:18: note: in expansion of macro 'KERN_SOH'
    11 | #define KERN_ERR KERN_SOH "3" /* error conditions */
       |                  ^~~~~~~~
./include/linux/printk.h:343:9: note: in expansion of macro 'KERN_ERR'
   343 |  printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
       |         ^~~~~~~~
mm/kfence/report.c:222:3: note: in expansion of macro 'pr_err'
   222 |   pr_err("Use-after-free %s at 0x%p (in kfence-#%td):\n",
       |   ^~~~~~
./include/linux/kern_levels.h:5:18: warning: format '%td' expects argument of type 'ptrdiff_t', but 
argument 2 has type 'long int' [-Wformat=]
     5 | #define KERN_SOH "\001"  /* ASCII Start Of Header */
       |                  ^~~~~~
./include/linux/kern_levels.h:24:19: note: in expansion of macro 'KERN_SOH'
    24 | #define KERN_CONT KERN_SOH "c"
       |                   ^~~~~~~~
./include/linux/printk.h:385:9: note: in expansion of macro 'KERN_CONT'
   385 |  printk(KERN_CONT fmt, ##__VA_ARGS__)
       |         ^~~~~~~~~
mm/kfence/report.c:229:3: note: in expansion of macro 'pr_cont'
   229 |   pr_cont(" (in kfence-#%td):\n", object_index);
       |   ^~~~~~~
./include/linux/kern_levels.h:5:18: warning: format '%td' expects argument of type 'ptrdiff_t', but 
argument 3 has type 'long int' [-Wformat=]
     5 | #define KERN_SOH "\001"  /* ASCII Start Of Header */
       |                  ^~~~~~
./include/linux/kern_levels.h:11:18: note: in expansion of macro 'KERN_SOH'
    11 | #define KERN_ERR KERN_SOH "3" /* error conditions */
       |                  ^~~~~~~~
./include/linux/printk.h:343:9: note: in expansion of macro 'KERN_ERR'
   343 |  printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
       |         ^~~~~~~~
mm/kfence/report.c:239:3: note: in expansion of macro 'pr_err'
   239 |   pr_err("Invalid free of 0x%p (in kfence-#%td):\n", (void *)address,
       |   ^~~~~~


Christophe