lkml.org 
[lkml]   [2019]   [Aug]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH 1/2] vsprintf: Prevent crash when dereferencing invalid pointers for %pD
    On Fri, Aug 9, 2019 at 4:28 AM Jia He <justin.he@arm.com> wrote:
    >
    > Commit 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid
    > pointers") prevents most crash except for %pD.
    > There is an additional pointer dereferencing before dentry_name.
    >
    > At least, vma->file can be NULL and be passed to printk %pD in
    > print_bad_pte, which can cause crash.
    >
    > This patch fixes it with introducing a new file_dentry_name.
    >

    Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>

    Perhaps you need to add a Fixes tag

    > Signed-off-by: Jia He <justin.he@arm.com>
    > ---
    > lib/vsprintf.c | 13 ++++++++++---
    > 1 file changed, 10 insertions(+), 3 deletions(-)
    >
    > diff --git a/lib/vsprintf.c b/lib/vsprintf.c
    > index 63937044c57d..b4a119176fdb 100644
    > --- a/lib/vsprintf.c
    > +++ b/lib/vsprintf.c
    > @@ -869,6 +869,15 @@ char *dentry_name(char *buf, char *end, const struct dentry *d, struct printf_sp
    > return widen_string(buf, n, end, spec);
    > }
    >
    > +static noinline_for_stack
    > +char *file_dentry_name(char *buf, char *end, const struct file *f,
    > + struct printf_spec spec, const char *fmt)
    > +{
    > + if (check_pointer(&buf, end, f, spec))
    > + return buf;
    > +
    > + return dentry_name(buf, end, f->f_path.dentry, spec, fmt);
    > +}
    > #ifdef CONFIG_BLOCK
    > static noinline_for_stack
    > char *bdev_name(char *buf, char *end, struct block_device *bdev,
    > @@ -2166,9 +2175,7 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
    > case 'C':
    > return clock(buf, end, ptr, spec, fmt);
    > case 'D':
    > - return dentry_name(buf, end,
    > - ((const struct file *)ptr)->f_path.dentry,
    > - spec, fmt);
    > + return file_dentry_name(buf, end, ptr, spec, fmt);
    > #ifdef CONFIG_BLOCK
    > case 'g':
    > return bdev_name(buf, end, ptr, spec, fmt);
    > --
    > 2.17.1
    >


    --
    With Best Regards,
    Andy Shevchenko

    \
     
     \ /
      Last update: 2019-08-09 12:53    [W:2.707 / U:0.708 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site