From: Kees Cook <keescook@chromium.org>
To: Helge Deller <deller@gmx.de>
Cc: kernel test robot <oliver.sang@intel.com>,
0day robot <lkp@intel.com>, LKML <linux-kernel@vger.kernel.org>,
lkp@lists.01.org, Alexey Dobriyan <adobriyan@gmail.com>,
Andrew Morton <akpm@linux-foundation.org>,
linux-fsdevel@vger.kernel.org, linux-hardening@vger.kernel.org,
Jann Horn <jannh@google.com>,
Qi Zheng <zhengqi.arch@bytedance.com>,
Vito Caputo <vcaputo@pengaru.com>,
Josh Poimboeuf <jpoimboe@redhat.com>,
stable@vger.kernel.org
Subject: /proc/$pid/chan kernel address exposures (was Re: [proc/wchan] 30a3a19273: leaking-addresses.proc.wchan./proc/bus/input/devices:B:KEY=1000000000007ff980000000007fffebeffdfffeffffffffffffffffffffe)
Date: Thu, 23 Sep 2021 18:01:51 -0700 [thread overview]
Message-ID: <202109231746.7B4C306CEC@keescook> (raw)
In-Reply-To: <d15378c8-8702-47ba-65b7-450f728793ed@gmx.de>
On Sun, Jan 03, 2021 at 07:25:36PM +0100, Helge Deller wrote:
> On 1/3/21 3:27 PM, kernel test robot wrote:
> > FYI, we noticed the following commit (built with gcc-9):
> >
> > commit: 30a3a192730a997bc4afff5765254175b6fb64f3 ("[PATCH] proc/wchan: Use printk format instead of lookup_symbol_name()")
> > url: https://github.com/0day-ci/linux/commits/Helge-Deller/proc-wchan-Use-printk-format-instead-of-lookup_symbol_name/20201218-010048
> > base: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git 09162bc32c880a791c6c0668ce0745cf7958f576
> >
> > in testcase: leaking-addresses
> > version: leaking-addresses-x86_64-4f19048-1_20201111
> > [...]
> > caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
>
> I don't see anything wrong with the wchan patch (30a3a192730a997bc4afff5765254175b6fb64f3),
> or that it could have leaked anything.
>
> Maybe the kernel test robot picked up the wchan patch by mistake ?
>
> > [...]
> > [2 wchan] 0xffffc9000000003c
^^^^^
As the root cause of a kernel address exposure, Jann pointed out[2]
commit 152c432b128c, which I've tracked to here, only to discover this
regression was, indeed, reported. :(
So, we have a few things:
1) wchan has been reporting "0" in the default x86 config (ORC unwinder)
for 4 years now.
2) non-x86 or non-ORC, wchan has been leaking raw kernel addresses since
commit 152c432b128c (v5.12).
3) the output of scripts/leaking_addresses.pl is hard to read. :)
We can fix 1 and 2 with:
https://lore.kernel.org/lkml/20210923233105.4045080-1-keescook@chromium.org/
(though that will need a Cc: stable now...)
If we don't do that, we still need to revert 152c432b128c in v5.12 and
later.
We should likely make leaking_addresses.pl a little more readable while
we're at it.
-Kees
[1] https://lore.kernel.org/lkml/20210921193249.el476vlhg5k6lfcq@shells.gnugeneration.com/
[2] https://lore.kernel.org/lkml/CAG48ez2zC=+PuNgezH53HBPZ8CXU5H=vkWx7nJs60G8RXt3w0Q@mail.gmail.com/
--
Kees Cook
WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <keescook@chromium.org>
To: lkp@lists.01.org
Subject: /proc/$pid/chan kernel address exposures (was Re: [proc/wchan] 30a3a19273: leaking-addresses.proc.wchan./proc/bus/input/devices:B:KEY=1000000000007ff980000000007fffebeffdfffeffffffffffffffffffffe)
Date: Thu, 23 Sep 2021 18:01:51 -0700 [thread overview]
Message-ID: <202109231746.7B4C306CEC@keescook> (raw)
In-Reply-To: <d15378c8-8702-47ba-65b7-450f728793ed@gmx.de>
[-- Attachment #1: Type: text/plain, Size: 2074 bytes --]
On Sun, Jan 03, 2021 at 07:25:36PM +0100, Helge Deller wrote:
> On 1/3/21 3:27 PM, kernel test robot wrote:
> > FYI, we noticed the following commit (built with gcc-9):
> >
> > commit: 30a3a192730a997bc4afff5765254175b6fb64f3 ("[PATCH] proc/wchan: Use printk format instead of lookup_symbol_name()")
> > url: https://github.com/0day-ci/linux/commits/Helge-Deller/proc-wchan-Use-printk-format-instead-of-lookup_symbol_name/20201218-010048
> > base: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git 09162bc32c880a791c6c0668ce0745cf7958f576
> >
> > in testcase: leaking-addresses
> > version: leaking-addresses-x86_64-4f19048-1_20201111
> > [...]
> > caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
>
> I don't see anything wrong with the wchan patch (30a3a192730a997bc4afff5765254175b6fb64f3),
> or that it could have leaked anything.
>
> Maybe the kernel test robot picked up the wchan patch by mistake ?
>
> > [...]
> > [2 wchan] 0xffffc9000000003c
^^^^^
As the root cause of a kernel address exposure, Jann pointed out[2]
commit 152c432b128c, which I've tracked to here, only to discover this
regression was, indeed, reported. :(
So, we have a few things:
1) wchan has been reporting "0" in the default x86 config (ORC unwinder)
for 4 years now.
2) non-x86 or non-ORC, wchan has been leaking raw kernel addresses since
commit 152c432b128c (v5.12).
3) the output of scripts/leaking_addresses.pl is hard to read. :)
We can fix 1 and 2 with:
https://lore.kernel.org/lkml/20210923233105.4045080-1-keescook(a)chromium.org/
(though that will need a Cc: stable now...)
If we don't do that, we still need to revert 152c432b128c in v5.12 and
later.
We should likely make leaking_addresses.pl a little more readable while
we're at it.
-Kees
[1] https://lore.kernel.org/lkml/20210921193249.el476vlhg5k6lfcq(a)shells.gnugeneration.com/
[2] https://lore.kernel.org/lkml/CAG48ez2zC=+PuNgezH53HBPZ8CXU5H=vkWx7nJs60G8RXt3w0Q(a)mail.gmail.com/
--
Kees Cook
next prev parent reply other threads:[~2021-09-24 1:01 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-17 16:54 [PATCH] proc/wchan: Use printk format instead of lookup_symbol_name() Helge Deller
2020-12-23 2:18 ` Andrew Morton
2020-12-23 9:48 ` Helge Deller
2020-12-23 20:29 ` Andrew Morton
2021-01-03 14:27 ` [proc/wchan] 30a3a19273: leaking-addresses.proc.wchan./proc/bus/input/devices:B:KEY=1000000000007ff980000000007fffebeffdfffeffffffffffffffffffffe kernel test robot
2021-01-03 14:27 ` kernel test robot
2021-01-03 18:25 ` Helge Deller
2021-01-03 18:25 ` Helge Deller
2021-01-04 13:27 ` Oliver Sang
2021-01-04 13:27 ` Oliver Sang
2021-09-24 1:01 ` Kees Cook [this message]
2021-09-24 1:01 ` /proc/$pid/chan kernel address exposures (was Re: [proc/wchan] 30a3a19273: leaking-addresses.proc.wchan./proc/bus/input/devices:B:KEY=1000000000007ff980000000007fffebeffdfffeffffffffffffffffffffe) Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202109231746.7B4C306CEC@keescook \
--to=keescook@chromium.org \
--cc=adobriyan@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=deller@gmx.de \
--cc=jannh@google.com \
--cc=jpoimboe@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=lkp@lists.01.org \
--cc=oliver.sang@intel.com \
--cc=stable@vger.kernel.org \
--cc=vcaputo@pengaru.com \
--cc=zhengqi.arch@bytedance.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.