All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, kernel test robot <oliver.sang@intel.com>,
	Vito Caputo <vcaputo@pengaru.com>, Jann Horn <jannh@google.com>,
	Kees Cook <keescook@chromium.org>,
	"Peter Zijlstra (Intel)" <peterz@infradead.org>
Subject: [PATCH 5.14 09/24] Revert "proc/wchan: use printk format instead of lookup_symbol_name()"
Date: Wed, 10 Nov 2021 19:44:01 +0100	[thread overview]
Message-ID: <20211110182003.631273586@linuxfoundation.org> (raw)
In-Reply-To: <20211110182003.342919058@linuxfoundation.org>

From: Kees Cook <keescook@chromium.org>

commit 54354c6a9f7fd5572d2b9ec108117c4f376d4d23 upstream.

This reverts commit 152c432b128cb043fc107e8f211195fe94b2159c.

When a kernel address couldn't be symbolized for /proc/$pid/wchan, it
would leak the raw value, a potential information exposure. This is a
regression compared to the safer pre-v5.12 behavior.

Reported-by: kernel test robot <oliver.sang@intel.com>
Reported-by: Vito Caputo <vcaputo@pengaru.com>
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20211008111626.090829198@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/proc/base.c |   21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -67,6 +67,7 @@
 #include <linux/mm.h>
 #include <linux/swap.h>
 #include <linux/rcupdate.h>
+#include <linux/kallsyms.h>
 #include <linux/stacktrace.h>
 #include <linux/resource.h>
 #include <linux/module.h>
@@ -385,17 +386,19 @@ static int proc_pid_wchan(struct seq_fil
 			  struct pid *pid, struct task_struct *task)
 {
 	unsigned long wchan;
+	char symname[KSYM_NAME_LEN];
 
-	if (ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
-		wchan = get_wchan(task);
-	else
-		wchan = 0;
-
-	if (wchan)
-		seq_printf(m, "%ps", (void *) wchan);
-	else
-		seq_putc(m, '0');
+	if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
+		goto print0;
 
+	wchan = get_wchan(task);
+	if (wchan && !lookup_symbol_name(wchan, symname)) {
+		seq_puts(m, symname);
+		return 0;
+	}
+
+print0:
+	seq_putc(m, '0');
 	return 0;
 }
 #endif /* CONFIG_KALLSYMS */



  parent reply	other threads:[~2021-11-10 18:55 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-11-10 18:43 [PATCH 5.14 00/24] 5.14.18-rc1 review Greg Kroah-Hartman
2021-11-10 18:43 ` [PATCH 5.14 01/24] ALSA: pcm: Check mmap capability of runtime dma buffer at first Greg Kroah-Hartman
2021-11-10 18:43 ` [PATCH 5.14 02/24] ALSA: pci: cs46xx: Fix set up buffer type properly Greg Kroah-Hartman
2021-11-10 18:43 ` [PATCH 5.14 03/24] KVM: x86: avoid warning with -Wbitwise-instead-of-logical Greg Kroah-Hartman
2021-11-10 18:43 ` [PATCH 5.14 04/24] Revert "x86/kvm: fix vcpu-id indexed array sizes" Greg Kroah-Hartman
2021-11-10 18:43 ` [PATCH 5.14 05/24] usb: ehci: handshake CMD_RUN instead of STS_HALT Greg Kroah-Hartman
2021-11-10 18:43 ` [PATCH 5.14 06/24] usb: gadget: Mark USB_FSL_QE broken on 64-bit Greg Kroah-Hartman
2021-11-10 18:43 ` [PATCH 5.14 07/24] usb: musb: Balance list entry in musb_gadget_queue Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 08/24] usb-storage: Add compatibility quirk flags for iODD 2531/2541 Greg Kroah-Hartman
2021-11-10 18:44 ` Greg Kroah-Hartman [this message]
2021-11-10 18:44 ` [PATCH 5.14 10/24] binder: use euid from cred instead of using task Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 11/24] binder: use cred instead of task for selinux checks Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 12/24] binder: use cred instead of task for getsecid Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 13/24] binder: dont detect sender/target during buffer cleanup Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 14/24] staging: rtl8712: fix use-after-free in rtl8712_dl_fw Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 15/24] isofs: Fix out of bound access for corrupted isofs image Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 16/24] comedi: dt9812: fix DMA buffers on stack Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 17/24] comedi: ni_usb6501: fix NULL-deref in command paths Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 18/24] comedi: vmk80xx: fix transfer-buffer overflows Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 19/24] comedi: vmk80xx: fix bulk-buffer overflow Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 20/24] comedi: vmk80xx: fix bulk and interrupt message timeouts Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 21/24] staging: r8712u: fix control-message timeout Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 22/24] staging: rtl8192u: fix control-message timeouts Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 23/24] media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.14 24/24] rsi: fix control-message timeout Greg Kroah-Hartman
2021-11-10 23:09 ` [PATCH 5.14 00/24] 5.14.18-rc1 review Florian Fainelli
2021-11-11 10:06 ` Naresh Kamboju
2021-11-11 14:30 ` Fox Chen
2021-11-11 16:28 ` Shuah Khan
2021-11-12  1:16 ` Guenter Roeck
2021-11-12 15:41 ` Jon Hunter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211110182003.631273586@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=jannh@google.com \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=oliver.sang@intel.com \
    --cc=peterz@infradead.org \
    --cc=stable@vger.kernel.org \
    --cc=vcaputo@pengaru.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.