From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: <1509415728.26592.40.camel@perches.com> From: Joe Perches Date: Mon, 30 Oct 2017 19:08:48 -0700 In-Reply-To: <20171030223346.GX12341@eros> References: <1508986436-31966-1-git-send-email-me@tobin.cc> <20171030223346.GX12341@eros> Content-Type: text/plain; charset="ISO-8859-1" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [kernel-hardening] Re: [PATCH V8 0/2] printk: hash addresses printed with %p To: "Tobin C. Harding" , Kees Cook Cc: kernel-hardening@lists.openwall.com, "Jason A. Donenfeld" , Theodore Ts'o , Linus Torvalds , Paolo Bonzini , Tycho Andersen , "Roberts, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , Chris Fries , Dave Weinstein , Daniel Micay , Djalal Harouni , LKML List-ID: On Tue, 2017-10-31 at 09:33 +1100, Tobin C. Harding wrote: > On Mon, Oct 30, 2017 at 03:03:21PM -0700, Kees Cook wrote: > > On Wed, Oct 25, 2017 at 7:53 PM, Tobin C. Harding wrote: > > > Here is the behaviour that this set implements. > > > > > > For kpt_restrict==0 > > > > > > Randomness not ready: > > > printed with %p: (pointer) # NOTE: with padding > > > Valid pointer: > > > printed with %pK: deadbeefdeadbeef > > > printed with %p: 0xdeadbeef > > > malformed specifier (eg %i): 0xdeadbeef > > > > I really think we can't include SPECIAL unless _every_ callsite of %p > > is actually doing "0x%p", and then we're replacing all of those. We're > > not doing that, though... > > > > $ git grep '%p\b' | wc -l > > 12766 > > $ git grep '0x%p\b' | wc -l > > 18370x > > > > If we need some kind of special marking that this is a hashed > > variable, that should be something other than "0x". If we're using the > > existing "(null)" and new "(pointer)" text, maybe "(hash:xxxxxx)" > > should be used instead? Then the (rare) callers with 0x become > > "0x(hash:xxxx)" and naked callers produce "(hash:xxxx)". > > > > I think the first step for this is to just leave SPECIAL out. > > Thanks Kees. V9 leaves SPECIAL out. Also V9 prints the whole 64 bit > address with the first 32 bits masked to zero. The intent being to _not_ > change the output format from what it currently is. So it will look like > this; > > 00000000c09e81d0 > > What do you think? > > Amusingly I think this whole conversation is going to come up again > when we do %pa, in inverse, since %pa currently does us SPECIAL. I once sent a patch set to remove SPECIAL from %pa and add 0x where necessary. https://patchwork.kernel.org/patch/3875471/ After that didn't happen, I removed the duplicated 0x%pa with a sed. https://patchwork.kernel.org/patch/8509421/ Sending a treewide sed patch would be fine with me. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753520AbdJaCJB (ORCPT ); Mon, 30 Oct 2017 22:09:01 -0400 Received: from smtprelay0177.hostedemail.com ([216.40.44.177]:53609 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751956AbdJaCI7 (ORCPT ); Mon, 30 Oct 2017 22:08:59 -0400 X-Session-Marker: 6A6F6540706572636865732E636F6D X-Spam-Summary: 13,1.2,0,,d41d8cd98f00b204,joe@perches.com,:::::::::::::::::::::::::::::::::::::::::::::,RULES_HIT:41:355:379:541:599:800:960:967:968:973:988:989:1260:1277:1311:1313:1314:1345:1359:1373:1437:1515:1516:1518:1534:1542:1593:1594:1711:1730:1747:1777:1792:2393:2525:2553:2561:2564:2682:2685:2693:2828:2859:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3315:3354:3622:3865:3866:3867:3868:3870:3871:3872:3873:3874:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4250:4321:4605:5007:6691:6742:6743:7550:7903:8985:9025:10008:10400:10848:11232:11658:11914:12043:12555:12740:12760:12895:12986:13439:14096:14097:14181:14659:14721:21080:21433:21451:21627:30003:30054:30070:30090:30091,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:,MSBL:0,DNSBL:none,Custom_rules:0:1:0,LFtime:2,LUA_SUMMARY:none X-HE-Tag: slave40_6a3f6bf78bd5c X-Filterd-Recvd-Size: 3656 Message-ID: <1509415728.26592.40.camel@perches.com> Subject: Re: [PATCH V8 0/2] printk: hash addresses printed with %p From: Joe Perches To: "Tobin C. Harding" , Kees Cook Cc: kernel-hardening@lists.openwall.com, "Jason A. Donenfeld" , "Theodore Ts'o" , Linus Torvalds , Paolo Bonzini , Tycho Andersen , "Roberts, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , Chris Fries , Dave Weinstein , Daniel Micay , Djalal Harouni , LKML Date: Mon, 30 Oct 2017 19:08:48 -0700 In-Reply-To: <20171030223346.GX12341@eros> References: <1508986436-31966-1-git-send-email-me@tobin.cc> <20171030223346.GX12341@eros> Content-Type: text/plain; charset="ISO-8859-1" X-Mailer: Evolution 3.26.1-1 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 2017-10-31 at 09:33 +1100, Tobin C. Harding wrote: > On Mon, Oct 30, 2017 at 03:03:21PM -0700, Kees Cook wrote: > > On Wed, Oct 25, 2017 at 7:53 PM, Tobin C. Harding wrote: > > > Here is the behaviour that this set implements. > > > > > > For kpt_restrict==0 > > > > > > Randomness not ready: > > > printed with %p: (pointer) # NOTE: with padding > > > Valid pointer: > > > printed with %pK: deadbeefdeadbeef > > > printed with %p: 0xdeadbeef > > > malformed specifier (eg %i): 0xdeadbeef > > > > I really think we can't include SPECIAL unless _every_ callsite of %p > > is actually doing "0x%p", and then we're replacing all of those. We're > > not doing that, though... > > > > $ git grep '%p\b' | wc -l > > 12766 > > $ git grep '0x%p\b' | wc -l > > 18370x > > > > If we need some kind of special marking that this is a hashed > > variable, that should be something other than "0x". If we're using the > > existing "(null)" and new "(pointer)" text, maybe "(hash:xxxxxx)" > > should be used instead? Then the (rare) callers with 0x become > > "0x(hash:xxxx)" and naked callers produce "(hash:xxxx)". > > > > I think the first step for this is to just leave SPECIAL out. > > Thanks Kees. V9 leaves SPECIAL out. Also V9 prints the whole 64 bit > address with the first 32 bits masked to zero. The intent being to _not_ > change the output format from what it currently is. So it will look like > this; > > 00000000c09e81d0 > > What do you think? > > Amusingly I think this whole conversation is going to come up again > when we do %pa, in inverse, since %pa currently does us SPECIAL. I once sent a patch set to remove SPECIAL from %pa and add 0x where necessary. https://patchwork.kernel.org/patch/3875471/ After that didn't happen, I removed the duplicated 0x%pa with a sed. https://patchwork.kernel.org/patch/8509421/ Sending a treewide sed patch would be fine with me.