linux-kernel - RE: [PATCH v2 03/28] vsprintf: %pf(%p)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <786516a0b71a4c6689592b89b146edec@AcuMS.aculab.com>
Date:   Fri, 20 May 2022 08:03:29 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Matthew Wilcox' <willy@...radead.org>
CC:     'Kent Overstreet' <kent.overstreet@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-mm@...r.kernel.org" <linux-mm@...r.kernel.org>,
        "pmladek@...e.com" <pmladek@...e.com>,
        "rostedt@...dmis.org" <rostedt@...dmis.org>,
        "senozhatsky@...omium.org" <senozhatsky@...omium.org>,
        "andriy.shevchenko@...ux.intel.com" 
        <andriy.shevchenko@...ux.intel.com>
Subject: RE: [PATCH v2 03/28] vsprintf: %pf(%p)

From: Matthew Wilcox
> Sent: 19 May 2022 22:15
> 
> On Thu, May 19, 2022 at 09:06:24PM +0000, David Laight wrote:
> > I suspect this a very good way to blow the kernel stack.
> > The highest stack use is already very likely to be inside
> > the printf code in an error path somewhere.
> 
> ...
> 
> > Double copying using a temporary buffer isn't the end of the world.
> 
> How can you hold both of these positions simultaneously?

Mostly you only need a short(ish) buffer to format a single item.
But even a full line buffer is probably less stack than a
nested printf call.
It certainly makes it possible for static analysis to determine
maximum stack depth.

That made me realise that one of the problems doing static
analysis of stack depth is indirect calls.
The hashes that (IIRC) fine-ibt add to indirect calls
and functions make it possible to tie these together.
So you can determine the worst one of the called functions
and use it for the stack depth at the call sites.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)