| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <467a3c3c-8a52-9a74-c77f-bcb51b03d603@huawei.com>
Date: Sat, 11 Sep 2021 10:25:54 +0800
From: Xiaoming Ni <nixiaoming@...wei.com>
To: Timur Tabi <timur@...nel.org>, Petr Mladek <pmladek@...e.com>,
"Steven Rostedt" <rostedt@...dmis.org>,
Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
Vlastimil Babka <vbabka@...e.cz>,
"Andy Shevchenko" <andriy.shevchenko@...ux.intel.com>,
Matthew Wilcox <willy@...radead.org>,
<akpm@...ux-foundation.org>,
Linus Torvalds <torvalds@...ux-foundation.org>,
<roman.fietze@...na.com>, Kees Cook <keescook@...omium.org>,
John Ogness <john.ogness@...utronix.de>,
<akinobu.mita@...il.com>, <glider@...gle.com>,
Andrey Konovalov <andreyknvl@...gle.com>,
Marco Elver <elver@...gle.com>,
Rasmus Villemoes <linux@...musvillemoes.dk>,
Pavel Machek <pavel@....cz>,
Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
<linux-kernel@...r.kernel.org>, <linux-mm@...ck.org>
Subject: Re: [PATCH 3/3] [v4] lib/vsprintf: no_hash_pointers prints all
addresses as unhashed
On 2021/2/15 0:13, Timur Tabi wrote:
> If the no_hash_pointers command line parameter is set, then
> printk("%p") will print pointers as unhashed, which is useful for
> debugging purposes. This change applies to any function that uses
> vsprintf, such as print_hex_dump() and seq_buf_printf().
>
> A large warning message is displayed if this option is enabled.
> Unhashed pointers expose kernel addresses, which can be a security
> risk.
>
> Also update test_printf to skip the hashed pointer tests if the
> command-line option is set.
>
> Signed-off-by: Timur Tabi <timur@...nel.org>
> Acked-by: Petr Mladek <pmladek@...e.com>
> Acked-by: Randy Dunlap <rdunlap@...radead.org>
> Acked-by: Sergey Senozhatsky <sergey.senozhatsky@...il.com>
> Acked-by: Vlastimil Babka <vbabka@...e.cz>
> Acked-by: Marco Elver <elver@...gle.com>
> ---
> .../admin-guide/kernel-parameters.txt | 15 ++++++++
> lib/test_printf.c | 8 +++++
> lib/vsprintf.c | 36 +++++++++++++++++--
> 3 files changed, 57 insertions(+), 2 deletions(-)
>
> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> index a10b545c2070..c8993a296e71 100644
> --- a/Documentation/admin-guide/kernel-parameters.txt
> +++ b/Documentation/admin-guide/kernel-parameters.txt
> @@ -3281,6 +3281,21 @@
> in certain environments such as networked servers or
> real-time systems.
>
> + no_hash_pointers
> + Force pointers printed to the console or buffers to be
> + unhashed. By default, when a pointer is printed via %p
> + format string, that pointer is "hashed", i.e. obscured
> + by hashing the pointer value. This is a security feature
> + that hides actual kernel addresses from unprivileged
> + users, but it also makes debugging the kernel more
> + difficult since unequal pointers can no longer be
> + compared. However, if this command-line option is
> + specified, then all normal pointers will have their true
> + value printed. Pointers printed via %pK may still be
> + hashed. This option should only be specified when
> + debugging the kernel. Please do not use on production
> + kernels.
> +
> nohibernate [HIBERNATION] Disable hibernation and resume.
>
> nohz= [KNL] Boottime enable/disable dynamic ticks
> diff --git a/lib/test_printf.c b/lib/test_printf.c
> index ad2bcfa8caa1..a6755798e9e6 100644
> --- a/lib/test_printf.c
> +++ b/lib/test_printf.c
> @@ -35,6 +35,8 @@ KSTM_MODULE_GLOBALS();
> static char *test_buffer __initdata;
> static char *alloced_buffer __initdata;
>
> +extern bool no_hash_pointers;
> +
> static int __printf(4, 0) __init
> do_test(int bufsize, const char *expect, int elen,
> const char *fmt, va_list ap)
> @@ -301,6 +303,12 @@ plain(void)
> {
> int err;
>
> + if (no_hash_pointers) {
> + pr_warn("skipping plain 'p' tests");
> + skipped_tests += 2;
> + return;
> + }
> +
> err = plain_hash();
> if (err) {
> pr_warn("plain 'p' does not appear to be hashed\n");
> diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> index 3b53c73580c5..41ddc353ebb8 100644
> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -2090,6 +2090,32 @@ char *fwnode_string(char *buf, char *end, struct fwnode_handle *fwnode,
> return widen_string(buf, buf - buf_start, end, spec);
> }
>
> +/* Disable pointer hashing if requested */
> +bool no_hash_pointers __ro_after_init;
> +EXPORT_SYMBOL_GPL(no_hash_pointers);
Why do we need to export the no_hash_pointers variable and not declare
it in any header file?
Thanks.
Xiaoming Ni
> +
> +static int __init no_hash_pointers_enable(char *str)
> +{
> + no_hash_pointers = true;
> +
> + pr_warn("**********************************************************\n");
> + pr_warn("** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **\n");
> + pr_warn("** **\n");
> + pr_warn("** This system shows unhashed kernel memory addresses **\n");
> + pr_warn("** via the console, logs, and other interfaces. This **\n");
> + pr_warn("** might reduce the security of your system. **\n");
> + pr_warn("** **\n");
> + pr_warn("** If you see this message and you are not debugging **\n");
> + pr_warn("** the kernel, report this immediately to your system **\n");
> + pr_warn("** administrator! **\n");
> + pr_warn("** **\n");
> + pr_warn("** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE **\n");
> + pr_warn("**********************************************************\n");
> +
> + return 0;
> +}
> +early_param("no_hash_pointers", no_hash_pointers_enable);
> +
> /*
> * Show a '%p' thing. A kernel extension is that the '%p' is followed
> * by an extra set of alphanumeric characters that are extended format
> @@ -2297,8 +2323,14 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
> }
> }
>
> - /* default is to _not_ leak addresses, hash before printing */
> - return ptr_to_id(buf, end, ptr, spec);
> + /*
> + * default is to _not_ leak addresses, so hash before printing,
> + * unless no_hash_pointers is specified on the command line.
> + */
> + if (unlikely(no_hash_pointers))
> + return pointer_string(buf, end, ptr, spec);
> + else
> + return ptr_to_id(buf, end, ptr, spec);
> }
>
> /*
>
Powered by blists - more mailing lists