From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: <1509492793.31043.12.camel@perches.com> From: Joe Perches Date: Tue, 31 Oct 2017 16:33:13 -0700 In-Reply-To: <20171031231619.GB3585@eros> References: <1508986436-31966-1-git-send-email-me@tobin.cc> <20171030223346.GX12341@eros> <1509415728.26592.40.camel@perches.com> <20171031231619.GB3585@eros> Content-Type: text/plain; charset="ISO-8859-1" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [kernel-hardening] Re: [PATCH V8 0/2] printk: hash addresses printed with %p To: "Tobin C. Harding" Cc: Kees Cook , kernel-hardening@lists.openwall.com, "Jason A. Donenfeld" , Theodore Ts'o , Linus Torvalds , Paolo Bonzini , Tycho Andersen , "Roberts, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , Chris Fries , Dave Weinstein , Daniel Micay , Djalal Harouni , LKML , Vinod Koul , Mauro Carvalho Chehab List-ID: On Wed, 2017-11-01 at 10:16 +1100, Tobin C. Harding wrote: > On Mon, Oct 30, 2017 at 07:08:48PM -0700, Joe Perches wrote: > > On Tue, 2017-10-31 at 09:33 +1100, Tobin C. Harding wrote: > > > On Mon, Oct 30, 2017 at 03:03:21PM -0700, Kees Cook wrote: > > > > On Wed, Oct 25, 2017 at 7:53 PM, Tobin C. Harding wrote: > > > > > Here is the behaviour that this set implements. > > > > > > > > > > For kpt_restrict==0 > > > > > > > > > > Randomness not ready: > > > > > printed with %p: (pointer) # NOTE: with padding > > > > > Valid pointer: > > > > > printed with %pK: deadbeefdeadbeef > > > > > printed with %p: 0xdeadbeef > > > > > malformed specifier (eg %i): 0xdeadbeef > > > > > > > > I really think we can't include SPECIAL unless _every_ callsite of %p > > > > is actually doing "0x%p", and then we're replacing all of those. We're > > > > not doing that, though... > > > > > > > > $ git grep '%p\b' | wc -l > > > > 12766 > > > > $ git grep '0x%p\b' | wc -l > > > > 18370x > > > > > > > > If we need some kind of special marking that this is a hashed > > > > variable, that should be something other than "0x". If we're using the > > > > existing "(null)" and new "(pointer)" text, maybe "(hash:xxxxxx)" > > > > should be used instead? Then the (rare) callers with 0x become > > > > "0x(hash:xxxx)" and naked callers produce "(hash:xxxx)". > > > > > > > > I think the first step for this is to just leave SPECIAL out. > > > > > > Thanks Kees. V9 leaves SPECIAL out. Also V9 prints the whole 64 bit > > > address with the first 32 bits masked to zero. The intent being to _not_ > > > change the output format from what it currently is. So it will look like > > > this; > > > > > > 00000000c09e81d0 > > > > > > What do you think? > > > > > > Amusingly I think this whole conversation is going to come up again > > > when we do %pa, in inverse, since %pa currently does us SPECIAL. > > > > I once sent a patch set to remove SPECIAL from %pa > > and add 0x where necessary. > > > > https://patchwork.kernel.org/patch/3875471/ > > > > After that didn't happen, I removed the duplicated > > 0x%pa with a sed. > > > > https://patchwork.kernel.org/patch/8509421/ > > > > Sending a treewide sed patch would be fine with me. > > Cool, thanks Joe I'll keep this in mind for when we get to %pa. fyi: There are more of these misuses of 0x%pa now: $ git grep -E -n "0[xX]%pa[dp]?\b" drivers/dma/at_hdmac_regs.h:388: " desc: s%pad d%pad ctrl0x%x:0x%x l0x%pad\n", drivers/dma/coh901318.c:1322: dev_vdbg(COHC_2_DEV(cohc), "i %d, lli %p, ctrl 0x%x, src 0x%pad" drivers/dma/coh901318.c:1323: ", dst 0x%pad, link 0x%pad virt_link_addr 0x%p\n", drivers/dma/coh901318.c:2234: "[%s] channel %d src 0x%pad dest 0x%pad size %zu\n", drivers/media/platform/sti/delta/delta-mem.c:35: "%s allocate %d bytes of HW memory @(virt=0x%p, phy=0x%pad): %s\n", drivers/media/platform/sti/delta/delta-mem.c:46: "%s free %d bytes of HW memory @(virt=0x%p, phy=0x%pad): %s\n", drivers/media/platform/sti/delta/delta-v4l2.c:1147: dev_dbg(delta->dev, "%s au[%d] prepared; virt=0x%p, phy=0x%pad\n", drivers/media/platform/sti/delta/delta-v4l2.c:1503: "%s frame[%d] prepared; virt=0x%p, phy=0x%pad\n", drivers/media/platform/stm32/stm32-dcmi.c:486: dev_dbg(dcmi->dev, "buffer[%d] phy=0x%pad size=%zu\n", drivers/media/platform/ti-vpe/cal.c:496: cal_info(dev, "CAL Registers @ 0x%pa:\n", &dev->res->start); From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933169AbdJaXdY (ORCPT ); Tue, 31 Oct 2017 19:33:24 -0400 Received: from smtprelay0226.hostedemail.com ([216.40.44.226]:51848 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932817AbdJaXdU (ORCPT ); Tue, 31 Oct 2017 19:33:20 -0400 X-Session-Marker: 6A6F6540706572636865732E636F6D X-Spam-Summary: 13,1.2,0,,d41d8cd98f00b204,joe@perches.com,:::::::::::::::::::::::::::::::::::::::::::::::::,RULES_HIT:41:355:379:541:599:800:960:966:967:968:973:988:989:1260:1277:1311:1313:1314:1345:1359:1373:1437:1461:1515:1516:1518:1535:1543:1593:1594:1605:1711:1730:1747:1777:1792:1801:2196:2199:2393:2525:2553:2561:2564:2682:2685:2693:2828:2859:2902:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3315:3622:3865:3866:3867:3868:3870:3871:3872:3873:3874:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4250:4321:4385:4605:5007:6117:6119:6691:6742:6743:7550:7903:8603:9025:10008:10400:10848:11026:11232:11658:11914:12043:12555:12679:12740:12760:12895:12986:13439:13972:14093:14097:14181:14659:14721:21080:21433:21451:21626:30003:30054:30070:30090:30091,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:,MSBL:0,DNSBL:none,Custom_rules:0:1:0,LFtime:2,LUA_SUMMARY:none X-HE-Tag: park40_73aa6959d8038 X-Filterd-Recvd-Size: 5456 Message-ID: <1509492793.31043.12.camel@perches.com> Subject: Re: [PATCH V8 0/2] printk: hash addresses printed with %p From: Joe Perches To: "Tobin C. Harding" Cc: Kees Cook , kernel-hardening@lists.openwall.com, "Jason A. Donenfeld" , "Theodore Ts'o" , Linus Torvalds , Paolo Bonzini , Tycho Andersen , "Roberts, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , Chris Fries , Dave Weinstein , Daniel Micay , Djalal Harouni , LKML , Vinod Koul , Mauro Carvalho Chehab Date: Tue, 31 Oct 2017 16:33:13 -0700 In-Reply-To: <20171031231619.GB3585@eros> References: <1508986436-31966-1-git-send-email-me@tobin.cc> <20171030223346.GX12341@eros> <1509415728.26592.40.camel@perches.com> <20171031231619.GB3585@eros> Content-Type: text/plain; charset="ISO-8859-1" X-Mailer: Evolution 3.26.1-1 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 2017-11-01 at 10:16 +1100, Tobin C. Harding wrote: > On Mon, Oct 30, 2017 at 07:08:48PM -0700, Joe Perches wrote: > > On Tue, 2017-10-31 at 09:33 +1100, Tobin C. Harding wrote: > > > On Mon, Oct 30, 2017 at 03:03:21PM -0700, Kees Cook wrote: > > > > On Wed, Oct 25, 2017 at 7:53 PM, Tobin C. Harding wrote: > > > > > Here is the behaviour that this set implements. > > > > > > > > > > For kpt_restrict==0 > > > > > > > > > > Randomness not ready: > > > > > printed with %p: (pointer) # NOTE: with padding > > > > > Valid pointer: > > > > > printed with %pK: deadbeefdeadbeef > > > > > printed with %p: 0xdeadbeef > > > > > malformed specifier (eg %i): 0xdeadbeef > > > > > > > > I really think we can't include SPECIAL unless _every_ callsite of %p > > > > is actually doing "0x%p", and then we're replacing all of those. We're > > > > not doing that, though... > > > > > > > > $ git grep '%p\b' | wc -l > > > > 12766 > > > > $ git grep '0x%p\b' | wc -l > > > > 18370x > > > > > > > > If we need some kind of special marking that this is a hashed > > > > variable, that should be something other than "0x". If we're using the > > > > existing "(null)" and new "(pointer)" text, maybe "(hash:xxxxxx)" > > > > should be used instead? Then the (rare) callers with 0x become > > > > "0x(hash:xxxx)" and naked callers produce "(hash:xxxx)". > > > > > > > > I think the first step for this is to just leave SPECIAL out. > > > > > > Thanks Kees. V9 leaves SPECIAL out. Also V9 prints the whole 64 bit > > > address with the first 32 bits masked to zero. The intent being to _not_ > > > change the output format from what it currently is. So it will look like > > > this; > > > > > > 00000000c09e81d0 > > > > > > What do you think? > > > > > > Amusingly I think this whole conversation is going to come up again > > > when we do %pa, in inverse, since %pa currently does us SPECIAL. > > > > I once sent a patch set to remove SPECIAL from %pa > > and add 0x where necessary. > > > > https://patchwork.kernel.org/patch/3875471/ > > > > After that didn't happen, I removed the duplicated > > 0x%pa with a sed. > > > > https://patchwork.kernel.org/patch/8509421/ > > > > Sending a treewide sed patch would be fine with me. > > Cool, thanks Joe I'll keep this in mind for when we get to %pa. fyi: There are more of these misuses of 0x%pa now: $ git grep -E -n "0[xX]%pa[dp]?\b" drivers/dma/at_hdmac_regs.h:388: " desc: s%pad d%pad ctrl0x%x:0x%x l0x%pad\n", drivers/dma/coh901318.c:1322: dev_vdbg(COHC_2_DEV(cohc), "i %d, lli %p, ctrl 0x%x, src 0x%pad" drivers/dma/coh901318.c:1323: ", dst 0x%pad, link 0x%pad virt_link_addr 0x%p\n", drivers/dma/coh901318.c:2234: "[%s] channel %d src 0x%pad dest 0x%pad size %zu\n", drivers/media/platform/sti/delta/delta-mem.c:35: "%s allocate %d bytes of HW memory @(virt=0x%p, phy=0x%pad): %s\n", drivers/media/platform/sti/delta/delta-mem.c:46: "%s free %d bytes of HW memory @(virt=0x%p, phy=0x%pad): %s\n", drivers/media/platform/sti/delta/delta-v4l2.c:1147: dev_dbg(delta->dev, "%s au[%d] prepared; virt=0x%p, phy=0x%pad\n", drivers/media/platform/sti/delta/delta-v4l2.c:1503: "%s frame[%d] prepared; virt=0x%p, phy=0x%pad\n", drivers/media/platform/stm32/stm32-dcmi.c:486: dev_dbg(dcmi->dev, "buffer[%d] phy=0x%pad size=%zu\n", drivers/media/platform/ti-vpe/cal.c:496: cal_info(dev, "CAL Registers @ 0x%pa:\n", &dev->res->start);