lkml.org 
[lkml]   [2020]   [Feb]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH v2] vsprintf: don't obfuscate NULL and error pointers
On Wed, Feb 19, 2020 at 7:13 PM Ilya Dryomov <idryomov@gmail.com> wrote:
>
> I don't see what security concern is addressed by obfuscating NULL
> and IS_ERR() error pointers, printed with %p/%pK. Given the number
> of sites where %p is used (over 10000) and the fact that NULL pointers
> aren't uncommon, it probably wouldn't take long for an attacker to
> find the hash that corresponds to 0. Although harder, the same goes
> for most common error values, such as -1, -2, -11, -14, etc.
>
> The NULL part actually fixes a regression: NULL pointers weren't
> obfuscated until commit 3e5903eb9cff ("vsprintf: Prevent crash when
> dereferencing invalid pointers") which went into 5.2. I'm tacking
> the IS_ERR() part on here because error pointers won't leak kernel
> addresses and printing them as pointers shouldn't be any different
> from e.g. %d with PTR_ERR_OR_ZERO(). Obfuscating them just makes
> debugging based on existing pr_debug and friends excruciating.
>
> Note that the "always print 0's for %pK when kptr_restrict == 2"
> behaviour which goes way back is left as is.
>
> Example output with the patch applied:
>
> ptr error-ptr NULL
> %p: 0000000001f8cc5b fffffffffffffff2 0000000000000000
> %pK, kptr = 0: 0000000001f8cc5b fffffffffffffff2 0000000000000000
> %px: ffff888048c04020 fffffffffffffff2 0000000000000000
> %pK, kptr = 1: ffff888048c04020 fffffffffffffff2 0000000000000000
> %pK, kptr = 2: 0000000000000000 0000000000000000 0000000000000000

...

> +/*
> + * NULL pointers aren't hashed.
> + */
> static void __init
> null_pointer(void)
> {
> - test_hashed("%p", NULL);
> + test(ZEROS "00000000", "%p", NULL);
> test(ZEROS "00000000", "%px", NULL);
> test("(null)", "%pE", NULL);
> }
>
> +/*
> + * Error pointers aren't hashed.
> + */
> +static void __init
> +error_pointer(void)
> +{
> + test(ONES "fffffff5", "%p", ERR_PTR(-EAGAIN));
> + test(ONES "fffffff5", "%px", ERR_PTR(-EAGAIN));

> + test("(efault)", "%pE", ERR_PTR(-EAGAIN));

Hmm... Is capital E on purpose here?
Maybe we may use something else ('%ph'?) for sake of deviation?

> +}

--
With Best Regards,
Andy Shevchenko

\
 
 \ /
  Last update: 2020-02-19 18:37    [W:0.086 / U:0.620 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site