* [PATCH] vsprintf: Prevent NULL dereference using %pNF
@ 2012-01-17 18:37 Joe Perches
2012-01-17 18:46 ` David Miller
0 siblings, 1 reply; 10+ messages in thread
From: Joe Perches @ 2012-01-17 18:37 UTC (permalink / raw)
To: Michał Mirosław; +Cc: David S. Miller, LKML
Passing NULL to %pNF is done in skb_gso_segment
which could be dereferenced.
Add noinline_for_stack to function.
Make pointer argument the actual type.
Check pointer for NULL and use 0 when so.
Signed-off-by: Joe Perches <joe@perches.com>
---
lib/vsprintf.c | 16 ++++++++++++----
1 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 8e75003..0f1dfd9 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -777,16 +777,24 @@ char *uuid_string(char *buf, char *end, const u8 *addr,
return string(buf, end, uuid, spec);
}
-static
-char *netdev_feature_string(char *buf, char *end, const u8 *addr,
- struct printf_spec spec)
+static noinline_for_stack
+char *netdev_feature_string(char *buf, char *end,
+ const netdev_features_t *features,
+ struct printf_spec spec)
{
+ unsigned long long num;
+
+ if (features)
+ num = (unsigned long long)*features;
+ else
+ num = 0;
+
spec.flags |= SPECIAL | SMALL | ZEROPAD;
if (spec.field_width == -1)
spec.field_width = 2 + 2 * sizeof(netdev_features_t);
spec.base = 16;
- return number(buf, end, *(const netdev_features_t *)addr, spec);
+ return number(buf, end, num, spec);
}
int kptr_restrict __read_mostly;
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH] vsprintf: Prevent NULL dereference using %pNF
2012-01-17 18:37 [PATCH] vsprintf: Prevent NULL dereference using %pNF Joe Perches
@ 2012-01-17 18:46 ` David Miller
2012-01-17 18:51 ` Joe Perches
0 siblings, 1 reply; 10+ messages in thread
From: David Miller @ 2012-01-17 18:46 UTC (permalink / raw)
To: joe; +Cc: mirq-linux, linux-kernel
From: Joe Perches <joe@perches.com>
Date: Tue, 17 Jan 2012 10:37:13 -0800
> Passing NULL to %pNF is done in skb_gso_segment
> which could be dereferenced.
skb_gso_segment() should be fixed instead.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] vsprintf: Prevent NULL dereference using %pNF
2012-01-17 18:46 ` David Miller
@ 2012-01-17 18:51 ` Joe Perches
2012-01-17 18:52 ` David Miller
2012-01-17 19:39 ` Michał Mirosław
0 siblings, 2 replies; 10+ messages in thread
From: Joe Perches @ 2012-01-17 18:51 UTC (permalink / raw)
To: David Miller; +Cc: mirq-linux, linux-kernel
On Tue, 2012-01-17 at 13:46 -0500, David Miller wrote:
> From: Joe Perches <joe@perches.com>
> Date: Tue, 17 Jan 2012 10:37:13 -0800
> > Passing NULL to %pNF is done in skb_gso_segment
> > which could be dereferenced.
> skb_gso_segment() should be fixed instead.
Maybe. Dereferencing NULL is bad form.
Michał Mirosław should fix that as it's his patch.
noinline_for_stack should be added anyway.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] vsprintf: Prevent NULL dereference using %pNF
2012-01-17 18:51 ` Joe Perches
@ 2012-01-17 18:52 ` David Miller
2012-01-17 18:54 ` Joe Perches
2012-01-17 19:39 ` Michał Mirosław
1 sibling, 1 reply; 10+ messages in thread
From: David Miller @ 2012-01-17 18:52 UTC (permalink / raw)
To: joe; +Cc: mirq-linux, linux-kernel
From: Joe Perches <joe@perches.com>
Date: Tue, 17 Jan 2012 10:51:13 -0800
> On Tue, 2012-01-17 at 13:46 -0500, David Miller wrote:
>> From: Joe Perches <joe@perches.com>
>> Date: Tue, 17 Jan 2012 10:37:13 -0800
>> > Passing NULL to %pNF is done in skb_gso_segment
>> > which could be dereferenced.
>> skb_gso_segment() should be fixed instead.
>
> Maybe. Dereferencing NULL is bad form.
We don't check for NULL for IPV4 or IPV6 addresses, no reason
to treat this any differently.
Either do it for all %pX things, or none of them.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] vsprintf: Prevent NULL dereference using %pNF
2012-01-17 18:52 ` David Miller
@ 2012-01-17 18:54 ` Joe Perches
2012-01-17 18:59 ` David Miller
0 siblings, 1 reply; 10+ messages in thread
From: Joe Perches @ 2012-01-17 18:54 UTC (permalink / raw)
To: David Miller; +Cc: mirq-linux, linux-kernel
On Tue, 2012-01-17 at 13:52 -0500, David Miller wrote:
> From: Joe Perches <joe@perches.com>
> Date: Tue, 17 Jan 2012 10:51:13 -0800
>
> > On Tue, 2012-01-17 at 13:46 -0500, David Miller wrote:
> >> From: Joe Perches <joe@perches.com>
> >> Date: Tue, 17 Jan 2012 10:37:13 -0800
> >> > Passing NULL to %pNF is done in skb_gso_segment
> >> > which could be dereferenced.
> >> skb_gso_segment() should be fixed instead.
> >
> > Maybe. Dereferencing NULL is bad form.
>
> We don't check for NULL for IPV4 or IPV6 addresses,
Because we don't pass NULL addresses.
> no reason
> to treat this any differently.
A NULL address is specifically passed here.
> Either do it for all %pX things, or none of them.
Maybe.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] vsprintf: Prevent NULL dereference using %pNF
2012-01-17 18:54 ` Joe Perches
@ 2012-01-17 18:59 ` David Miller
0 siblings, 0 replies; 10+ messages in thread
From: David Miller @ 2012-01-17 18:59 UTC (permalink / raw)
To: joe; +Cc: mirq-linux, linux-kernel
From: Joe Perches <joe@perches.com>
Date: Tue, 17 Jan 2012 10:54:56 -0800
> On Tue, 2012-01-17 at 13:52 -0500, David Miller wrote:
>> From: Joe Perches <joe@perches.com>
>> no reason
>> to treat this any differently.
>
> A NULL address is specifically passed here.
And I said fix that skb_gso_whatever case, because it's wrong.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] vsprintf: Prevent NULL dereference using %pNF
2012-01-17 18:51 ` Joe Perches
2012-01-17 18:52 ` David Miller
@ 2012-01-17 19:39 ` Michał Mirosław
2012-01-17 19:43 ` Joe Perches
1 sibling, 1 reply; 10+ messages in thread
From: Michał Mirosław @ 2012-01-17 19:39 UTC (permalink / raw)
To: Joe Perches; +Cc: David Miller, linux-kernel
On Tue, Jan 17, 2012 at 10:51:13AM -0800, Joe Perches wrote:
> On Tue, 2012-01-17 at 13:46 -0500, David Miller wrote:
> > From: Joe Perches <joe@perches.com>
> > Date: Tue, 17 Jan 2012 10:37:13 -0800
> > > Passing NULL to %pNF is done in skb_gso_segment
> > > which could be dereferenced.
> > skb_gso_segment() should be fixed instead.
> Maybe. Dereferencing NULL is bad form.
> Michał Mirosław should fix that as it's his patch.
Will do. This is in WARN() and easily fixed.
> noinline_for_stack should be added anyway.
Why? There are no local variables there and inlining this function would
actually save stack space as no stack frame would be created for the call.
Best Regards,
Michał Mirosław
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] vsprintf: Prevent NULL dereference using %pNF
2012-01-17 19:39 ` Michał Mirosław
@ 2012-01-17 19:43 ` Joe Perches
2012-01-17 21:12 ` Michał Mirosław
0 siblings, 1 reply; 10+ messages in thread
From: Joe Perches @ 2012-01-17 19:43 UTC (permalink / raw)
To: Michał Mirosław; +Cc: David Miller, linux-kernel
On Tue, 2012-01-17 at 20:39 +0100, Michał Mirosław wrote:
> On Tue, Jan 17, 2012 at 10:51:13AM -0800, Joe Perches wrote:
> > On Tue, 2012-01-17 at 13:46 -0500, David Miller wrote:
> > > From: Joe Perches <joe@perches.com>
> > > Date: Tue, 17 Jan 2012 10:37:13 -0800
> > > > Passing NULL to %pNF is done in skb_gso_segment
> > > > which could be dereferenced.
> > > skb_gso_segment() should be fixed instead.
> > Maybe. Dereferencing NULL is bad form.
> > Michał Mirosław should fix that as it's his patch.
>
> Will do. This is in WARN() and easily fixed.
>
> > noinline_for_stack should be added anyway.
>
> Why? There are no local variables there and inlining this function would
> actually save stack space as no stack frame would be created for the call.
Isn't an additional copy of "struct printf_spec spec" on the stack
in function pointer() now?
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] vsprintf: Prevent NULL dereference using %pNF
2012-01-17 19:43 ` Joe Perches
@ 2012-01-17 21:12 ` Michał Mirosław
2012-01-18 2:43 ` Joe Perches
0 siblings, 1 reply; 10+ messages in thread
From: Michał Mirosław @ 2012-01-17 21:12 UTC (permalink / raw)
To: Joe Perches; +Cc: David Miller, linux-kernel
On Tue, Jan 17, 2012 at 11:43:40AM -0800, Joe Perches wrote:
> On Tue, 2012-01-17 at 20:39 +0100, Michał Mirosław wrote:
> > On Tue, Jan 17, 2012 at 10:51:13AM -0800, Joe Perches wrote:
> > > On Tue, 2012-01-17 at 13:46 -0500, David Miller wrote:
> > > > From: Joe Perches <joe@perches.com>
> > > > Date: Tue, 17 Jan 2012 10:37:13 -0800
> > > > > Passing NULL to %pNF is done in skb_gso_segment
> > > > > which could be dereferenced.
> > > > skb_gso_segment() should be fixed instead.
> > > Maybe. Dereferencing NULL is bad form.
> > > Michał Mirosław should fix that as it's his patch.
> > Will do. This is in WARN() and easily fixed.
> >
> > > noinline_for_stack should be added anyway.
> >
> > Why? There are no local variables there and inlining this function would
> > actually save stack space as no stack frame would be created for the call.
> Isn't an additional copy of "struct printf_spec spec" on the stack
> in function pointer() now?
If the function is inlined then gcc should know that original is not needed
after call and do no copy. Without inlining, gcc should too, optimize it
because it's a tail call.
We could read the generated assembly to be sure, of course.
Best Regards,
Michał Mirosław
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] vsprintf: Prevent NULL dereference using %pNF
2012-01-17 21:12 ` Michał Mirosław
@ 2012-01-18 2:43 ` Joe Perches
0 siblings, 0 replies; 10+ messages in thread
From: Joe Perches @ 2012-01-18 2:43 UTC (permalink / raw)
To: Michał Mirosław; +Cc: David Miller, linux-kernel
On Tue, 2012-01-17 at 22:12 +0100, Michał Mirosław wrote:
> On Tue, Jan 17, 2012 at 11:43:40AM -0800, Joe Perches wrote:
> > Isn't an additional copy of "struct printf_spec spec" on the stack
> > in function pointer() now?
> If the function is inlined then gcc should know that original is not needed
> after call and do no copy. Without inlining, gcc should too, optimize it
> because it's a tail call.
> We could read the generated assembly to be sure, of course.
At least for x86/gcc 4.6, it seems it doesn't make any difference.
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2012-01-18 2:43 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-01-17 18:37 [PATCH] vsprintf: Prevent NULL dereference using %pNF Joe Perches
2012-01-17 18:46 ` David Miller
2012-01-17 18:51 ` Joe Perches
2012-01-17 18:52 ` David Miller
2012-01-17 18:54 ` Joe Perches
2012-01-17 18:59 ` David Miller
2012-01-17 19:39 ` Michał Mirosław
2012-01-17 19:43 ` Joe Perches
2012-01-17 21:12 ` Michał Mirosław
2012-01-18 2:43 ` Joe Perches
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox