public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2] vsprintf: protect kernel from panic due to non-canonical pointer dereference
@ 2022-10-17 19:44 Jane Chu
  2022-10-17 20:27 ` Andy Shevchenko
  2022-10-18  7:10 ` kernel test robot
  0 siblings, 2 replies; 9+ messages in thread
From: Jane Chu @ 2022-10-17 19:44 UTC (permalink / raw)
  To: pmladek, rostedt, senozhatsky, andriy.shevchenko, linux,
	linux-kernel
  Cc: jane.chu

While debugging a separate issue, it was found that an invalid string
pointer could very well contain a non-canical address, such as
0x7665645f63616465. In that case, this line of defense isn't enough
to protect the kernel from crashing due to general protection fault

	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
                return "(efault)";

So run one more round of check via kern_addr_valid(). On architectures
that provide meaningful implementation, this line of check effectively
catches non-canonical pointers, etc.

Signed-off-by: Jane Chu <jane.chu@oracle.com>
---
 lib/vsprintf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index c414a8d9f1ea..b38c12ef1e45 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -698,6 +698,9 @@ static const char *check_pointer_msg(const void *ptr)
 	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
 		return "(efault)";
 
+	if (!kern_addr_valid((unsigned long)ptr))
+		return "(efault)";
+
 	return NULL;
 }
 
-- 
2.18.4


^ permalink raw reply related	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2022-10-20  1:00 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-10-17 19:44 [PATCH v2] vsprintf: protect kernel from panic due to non-canonical pointer dereference Jane Chu
2022-10-17 20:27 ` Andy Shevchenko
2022-10-17 21:12   ` Jane Chu
2022-10-18  7:40     ` Petr Mladek
2022-10-18 19:36       ` Jane Chu
2022-10-19  9:33         ` Petr Mladek
2022-10-19 20:02           ` Jane Chu
2022-10-20  1:00             ` Jane Chu
2022-10-18  7:10 ` kernel test robot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox