linux-kernel - Re: [PATCH v3 1/1] vsprintf: protect kernel from panic due to non-canonical pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202210201906.oGOTdCpv-lkp@intel.com>
Date:   Thu, 20 Oct 2022 19:41:43 +0800
From:   kernel test robot <lkp@...el.com>
To:     Jane Chu <jane.chu@...cle.com>, pmladek@...e.com,
        rostedt@...dmis.org, senozhatsky@...omium.org,
        andriy.shevchenko@...ux.intel.com, linux@...musvillemoes.dk,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org
Cc:     kbuild-all@...ts.01.org, wangkefeng.wang@...wei.com,
        konrad.wilk@...cle.com, haakon.bugge@...cle.com,
        john.haxby@...cle.com, jane.chu@...cle.com
Subject: Re: [PATCH v3 1/1] vsprintf: protect kernel from panic due to
 non-canonical pointer dereference

Hi Jane,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on linus/master]
[also build test ERROR on v6.1-rc1]
[cannot apply to next-20221020]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Jane-Chu/vsprintf-check-non-canonical-pointer-by-kern_addr_valid/20221020-103535
patch link:    https://lore.kernel.org/r/20221019193431.2923462-2-jane.chu%40oracle.com
patch subject: [PATCH v3 1/1] vsprintf: protect kernel from panic due to non-canonical pointer dereference
config: x86_64-rhel-8.3-func
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
reproduce (this is a W=1 build):
        # https://github.com/intel-lab-lkp/linux/commit/7da79322bb256f65be136ef3ca3d557e42da8ffe
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review Jane-Chu/vsprintf-check-non-canonical-pointer-by-kern_addr_valid/20221020-103535
        git checkout 7da79322bb256f65be136ef3ca3d557e42da8ffe
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@...el.com>

All errors (new ones prefixed by >>):

   lib/vsprintf.c: In function 'check_pointer_msg':
>> lib/vsprintf.c:701:14: error: implicit declaration of function 'kern_addr_valid'; did you mean 'virt_addr_valid'? [-Werror=implicit-function-declaration]
     701 |         if (!kern_addr_valid((unsigned long)ptr))
         |              ^~~~~~~~~~~~~~~
         |              virt_addr_valid
   lib/vsprintf.c: In function 'va_format':
   lib/vsprintf.c:1688:9: warning: function 'va_format' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format]
    1688 |         buf += vsnprintf(buf, end > buf ? end - buf : 0, va_fmt->fmt, va);
         |         ^~~
   cc1: some warnings being treated as errors


vim +701 lib/vsprintf.c

   687	
   688	/*
   689	 * Do not call any complex external code here. Nested printk()/vsprintf()
   690	 * might cause infinite loops. Failures might break printk() and would
   691	 * be hard to debug.
   692	 */
   693	static const char *check_pointer_msg(const void *ptr)
   694	{
   695		if (!ptr)
   696			return "(null)";
   697	
   698		if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
   699			return "(efault)";
   700	
 > 701		if (!kern_addr_valid((unsigned long)ptr))
   702			return "(efault)";
   703	
   704		return NULL;
   705	}
   706	

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp

View attachment "config" of type "text/plain" (170003 bytes)