| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202210181448.wRGyMFAY-lkp@intel.com>
Date: Tue, 18 Oct 2022 15:10:59 +0800
From: kernel test robot <lkp@...el.com>
To: Jane Chu <jane.chu@...cle.com>, pmladek@...e.com,
rostedt@...dmis.org, senozhatsky@...omium.org,
andriy.shevchenko@...ux.intel.com, linux@...musvillemoes.dk,
linux-kernel@...r.kernel.org
Cc: kbuild-all@...ts.01.org, jane.chu@...cle.com
Subject: Re: [PATCH v2] vsprintf: protect kernel from panic due to
non-canonical pointer dereference
Hi Jane,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on linus/master]
[also build test WARNING on v6.1-rc1 next-20221018]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Jane-Chu/vsprintf-protect-kernel-from-panic-due-to-non-canonical-pointer-dereference/20221018-034659
patch link: https://lore.kernel.org/r/20221017194447.2579441-1-jane.chu%40oracle.com
patch subject: [PATCH v2] vsprintf: protect kernel from panic due to non-canonical pointer dereference
config: i386-randconfig-a005
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
reproduce (this is a W=1 build):
# https://github.com/intel-lab-lkp/linux/commit/63a24b7174d63b2daa240f00f66913649cb8ae84
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Jane-Chu/vsprintf-protect-kernel-from-panic-due-to-non-canonical-pointer-dereference/20221018-034659
git checkout 63a24b7174d63b2daa240f00f66913649cb8ae84
# save the config file
mkdir build_dir && cp config build_dir/.config
make W=1 O=build_dir ARCH=i386 SHELL=/bin/bash
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@...el.com>
All warnings (new ones prefixed by >>):
lib/vsprintf.c: In function 'va_format':
lib/vsprintf.c:1688:9: warning: function 'va_format' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format]
1688 | buf += vsnprintf(buf, end > buf ? end - buf : 0, va_fmt->fmt, va);
| ^~~
lib/vsprintf.c: In function 'dentry_name':
>> lib/vsprintf.c:937:18: warning: array subscript -1 is below array bounds of 'const char *[4]' [-Warray-bounds]
937 | s = array[--i];
| ~~~~~^~~~~
lib/vsprintf.c:908:21: note: while referencing 'array'
908 | const char *array[4], *s;
| ^~~~~
vim +937 lib/vsprintf.c
6eea242f9bcdf8 Petr Mladek 2019-04-17 903
4b6ccca701ef59 Al Viro 2013-09-03 904 static noinline_for_stack
4b6ccca701ef59 Al Viro 2013-09-03 905 char *dentry_name(char *buf, char *end, const struct dentry *d, struct printf_spec spec,
4b6ccca701ef59 Al Viro 2013-09-03 906 const char *fmt)
4b6ccca701ef59 Al Viro 2013-09-03 907 {
4b6ccca701ef59 Al Viro 2013-09-03 908 const char *array[4], *s;
4b6ccca701ef59 Al Viro 2013-09-03 909 const struct dentry *p;
4b6ccca701ef59 Al Viro 2013-09-03 910 int depth;
4b6ccca701ef59 Al Viro 2013-09-03 911 int i, n;
4b6ccca701ef59 Al Viro 2013-09-03 912
4b6ccca701ef59 Al Viro 2013-09-03 913 switch (fmt[1]) {
4b6ccca701ef59 Al Viro 2013-09-03 914 case '2': case '3': case '4':
4b6ccca701ef59 Al Viro 2013-09-03 915 depth = fmt[1] - '0';
4b6ccca701ef59 Al Viro 2013-09-03 916 break;
4b6ccca701ef59 Al Viro 2013-09-03 917 default:
4b6ccca701ef59 Al Viro 2013-09-03 918 depth = 1;
4b6ccca701ef59 Al Viro 2013-09-03 919 }
4b6ccca701ef59 Al Viro 2013-09-03 920
4b6ccca701ef59 Al Viro 2013-09-03 921 rcu_read_lock();
4b6ccca701ef59 Al Viro 2013-09-03 922 for (i = 0; i < depth; i++, d = p) {
3e5903eb9cff70 Petr Mladek 2019-04-17 923 if (check_pointer(&buf, end, d, spec)) {
3e5903eb9cff70 Petr Mladek 2019-04-17 924 rcu_read_unlock();
3e5903eb9cff70 Petr Mladek 2019-04-17 925 return buf;
3e5903eb9cff70 Petr Mladek 2019-04-17 926 }
3e5903eb9cff70 Petr Mladek 2019-04-17 927
6aa7de059173a9 Mark Rutland 2017-10-23 928 p = READ_ONCE(d->d_parent);
6aa7de059173a9 Mark Rutland 2017-10-23 929 array[i] = READ_ONCE(d->d_name.name);
4b6ccca701ef59 Al Viro 2013-09-03 930 if (p == d) {
4b6ccca701ef59 Al Viro 2013-09-03 931 if (i)
4b6ccca701ef59 Al Viro 2013-09-03 932 array[i] = "";
4b6ccca701ef59 Al Viro 2013-09-03 933 i++;
4b6ccca701ef59 Al Viro 2013-09-03 934 break;
4b6ccca701ef59 Al Viro 2013-09-03 935 }
4b6ccca701ef59 Al Viro 2013-09-03 936 }
4b6ccca701ef59 Al Viro 2013-09-03 @937 s = array[--i];
4b6ccca701ef59 Al Viro 2013-09-03 938 for (n = 0; n != spec.precision; n++, buf++) {
4b6ccca701ef59 Al Viro 2013-09-03 939 char c = *s++;
4b6ccca701ef59 Al Viro 2013-09-03 940 if (!c) {
4b6ccca701ef59 Al Viro 2013-09-03 941 if (!i)
4b6ccca701ef59 Al Viro 2013-09-03 942 break;
4b6ccca701ef59 Al Viro 2013-09-03 943 c = '/';
4b6ccca701ef59 Al Viro 2013-09-03 944 s = array[--i];
4b6ccca701ef59 Al Viro 2013-09-03 945 }
4b6ccca701ef59 Al Viro 2013-09-03 946 if (buf < end)
4b6ccca701ef59 Al Viro 2013-09-03 947 *buf = c;
4b6ccca701ef59 Al Viro 2013-09-03 948 }
4b6ccca701ef59 Al Viro 2013-09-03 949 rcu_read_unlock();
cfccde04e28d26 Rasmus Villemoes 2016-01-15 950 return widen_string(buf, n, end, spec);
4b6ccca701ef59 Al Viro 2013-09-03 951 }
4b6ccca701ef59 Al Viro 2013-09-03 952
--
0-DAY CI Kernel Test Service
https://01.org/lkp
View attachment "config" of type "text/plain" (154878 bytes)
Powered by blists - more mailing lists