lkml.org 
[lkml]   [2017]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH V11 0/5] hash addresses printed with %p
    On Wed, Nov 29, 2017 at 03:20:40PM -0800, Andrew Morton wrote:
    > On Wed, 29 Nov 2017 13:05:00 +1100 "Tobin C. Harding" <me@tobin.cc> wrote:
    >
    > > Currently there exist approximately 14 000 places in the Kernel where
    > > addresses are being printed using an unadorned %p. This potentially
    > > leaks sensitive information regarding the Kernel layout in memory. Many
    > > of these calls are stale, instead of fixing every call lets hash the
    > > address by default before printing. This will of course break some
    > > users, forcing code printing needed addresses to be updated. We can add
    > > a printk specifier for this purpose (%px) to give developers a clear
    > > upgrade path for breakages caused by applying this patch set.
    > >
    > > The added advantage of hashing %p is that security is now opt-out, if
    > > you _really_ want the address you have to work a little harder and use
    > > %px.
    > >
    > > The idea for creating the printk specifier %px to print the actual
    > > address was suggested by Kees Cook (see below for email threads by
    > > subject).
    >
    > Maybe I'm being thick, but... if we're rendering these addresses
    > unusable by hashing them, why not just print something like
    > "<obscured>" in their place? That loses the uniqueness thing but I
    > wonder how valuable that is in practice?

    The discussion on this has been fragmented over _at least_ 5 patch sets
    with totally different subjects. And I only just added you to the CC
    list, my apologies if this is a bit confusing.

    Consensus was that if we provide a unique identifier (the hashed
    address) then this is useful for debugging (i.e differentiating between
    structs when you have a list of them).

    The first 32 bits (on 64 bit machines) were zeroed out because

    1. they are unnecessary in achieving the aim.
    2. it reduces noise.
    3. makes explicit some funny business was going on.

    And bonus points, hopefully we don't break userland tools that parse
    addresses if the format is still the same.

    thanks,
    Tobin.

    \
     
     \ /
      Last update: 2017-11-30 00:35    [W:3.436 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site