linux-kernel - Re: [RFC][PATCH] printf: Harden accessing pointer dereference in vsprintf()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6ithsz3wv5577jmfy2j3uoqq6esib3h2bbidhya7vpwf53kj6y@i6q6muyqkwoh>
Date: Tue, 7 Jan 2025 13:33:35 +0900
From: Sergey Senozhatsky <senozhatsky@...omium.org>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: LKML <linux-kernel@...r.kernel.org>, 
	Linus Torvalds <torvalds@...ux-foundation.org>, Andrew Morton <akpm@...ux-foundation.org>, 
	Petr Mladek <pmladek@...e.com>, Andy Shevchenko <andriy.shevchenko@...ux.intel.com>, 
	Rasmus Villemoes <linux@...musvillemoes.dk>, Sergey Senozhatsky <senozhatsky@...omium.org>, 
	Kees Cook <keescook@...omium.org>
Subject: Re: [RFC][PATCH] printf: Harden accessing pointer dereference in
 vsprintf()

On (25/01/06 17:27), Steven Rostedt wrote:
> @@ -695,12 +695,18 @@ static char *error_string(char *buf, char *end, const char *s,
>   */
>  static const char *check_pointer_msg(const void *ptr)
>  {
> +	char ch;
> +
>  	if (!ptr)
>  		return "(null)";
>  
>  	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
>  		return "(efault)";
>  
> +	/* Just test a single byte */
> +	if (copy_from_kernel_nofault(&ch, ptr, 1) < 0)
> +		return "(efault)";
> +

I might be wrong, but I recall that copy_from_kernel() (previously known
as probe_kernel_read()) did cause boot regressions in the past.  E.g.
Petr's commit 2ac5a3bf7042 ("vsprintf: Do not break early boot with
probing addresses").