Messages in this thread | | | From | Andy Shevchenko <> | Date | Fri, 9 Aug 2019 13:51:57 +0300 | Subject | Re: [PATCH 1/2] vsprintf: Prevent crash when dereferencing invalid pointers for %pD |
| |
On Fri, Aug 9, 2019 at 4:28 AM Jia He <justin.he@arm.com> wrote: > > Commit 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid > pointers") prevents most crash except for %pD. > There is an additional pointer dereferencing before dentry_name. > > At least, vma->file can be NULL and be passed to printk %pD in > print_bad_pte, which can cause crash. > > This patch fixes it with introducing a new file_dentry_name. >
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Perhaps you need to add a Fixes tag
> Signed-off-by: Jia He <justin.he@arm.com> > --- > lib/vsprintf.c | 13 ++++++++++--- > 1 file changed, 10 insertions(+), 3 deletions(-) > > diff --git a/lib/vsprintf.c b/lib/vsprintf.c > index 63937044c57d..b4a119176fdb 100644 > --- a/lib/vsprintf.c > +++ b/lib/vsprintf.c > @@ -869,6 +869,15 @@ char *dentry_name(char *buf, char *end, const struct dentry *d, struct printf_sp > return widen_string(buf, n, end, spec); > } > > +static noinline_for_stack > +char *file_dentry_name(char *buf, char *end, const struct file *f, > + struct printf_spec spec, const char *fmt) > +{ > + if (check_pointer(&buf, end, f, spec)) > + return buf; > + > + return dentry_name(buf, end, f->f_path.dentry, spec, fmt); > +} > #ifdef CONFIG_BLOCK > static noinline_for_stack > char *bdev_name(char *buf, char *end, struct block_device *bdev, > @@ -2166,9 +2175,7 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, > case 'C': > return clock(buf, end, ptr, spec, fmt); > case 'D': > - return dentry_name(buf, end, > - ((const struct file *)ptr)->f_path.dentry, > - spec, fmt); > + return file_dentry_name(buf, end, ptr, spec, fmt); > #ifdef CONFIG_BLOCK > case 'g': > return bdev_name(buf, end, ptr, spec, fmt); > -- > 2.17.1 >
-- With Best Regards, Andy Shevchenko
| |