From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752047AbdB0U5D (ORCPT ); Mon, 27 Feb 2017 15:57:03 -0500 Received: from smtprelay0108.hostedemail.com ([216.40.44.108]:50217 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751610AbdB0U5A (ORCPT ); Mon, 27 Feb 2017 15:57:00 -0500 X-Session-Marker: 6A6F6540706572636865732E636F6D X-Spam-Summary: 2,0,0,,d41d8cd98f00b204,joe@perches.com,:::::::::,RULES_HIT:41:355:379:541:800:960:973:982:988:989:1260:1345:1359:1437:1534:1541:1711:1730:1747:1777:1792:2197:2198:2199:2200:2393:2559:2562:2894:3138:3139:3140:3141:3142:3353:3653:3865:3866:3867:3868:3870:3872:3873:3874:4321:4605:5007:6119:6261:8957:10004:10848:11026:11232:11473:11658:11914:12043:12050:12291:12438:12555:12895:12986:13069:13161:13229:13311:13357:14181:14384:14394:14721:21080:21221:21433:30054:30070:30071,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fn,MSBL:0,DNSBL:none,Custom_rules:0:0:0,LFtime:27,LUA_SUMMARY:none X-HE-Tag: plant25_828ef19cd4225 X-Filterd-Recvd-Size: 2820 From: Joe Perches To: Andrew Morton , Andy Whitcroft Cc: "Roberts, William C" , kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org Subject: [PATCH] checkpatch: Add ability to find bad uses of vsprintf %p extensions Date: Mon, 27 Feb 2017 12:54:55 -0800 Message-Id: <163a690510e636a23187c0dc9caa09ddac6d4cde.1488228427.git.joe@perches.com> X-Mailer: git-send-email 2.10.0.rc2.1.g053435c In-Reply-To: <476DC76E7D1DF2438D32BFADF679FC562307BAE6@ORSMSX103.amr.corp.intel.com> References: <476DC76E7D1DF2438D32BFADF679FC562307BAE6@ORSMSX103.amr.corp.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org %pK was at least once misused at %pk in an out-of-tree module. This lead to some security concerns. Add the ability to track single and multiple line statements for misuses of %p. Signed-off-by: Joe Perches --- Andrew, this has gone back and forth a few times. It's imperfect as a patch context with just a single function addition can be missed, but that's not new with $stat tests and just this patch. Perhaps one day the $stat identification mechanism can be improved. Until then, can you please apply this? Thanks. scripts/checkpatch.pl | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl index ad5ea5c545b2..9293b8a1c121 100755 --- a/scripts/checkpatch.pl +++ b/scripts/checkpatch.pl @@ -5676,6 +5676,32 @@ sub process { } } + # check for vsprintf extension %p misuses + if ($^V && $^V ge 5.10.0 && + defined $stat && + $stat =~ /^\+(?![^\{]*\{\s*).*\b(\w+)\s*\(.*$String\s*,/s && + $1 !~ /^_*volatile_*$/) { + my $bad_extension = ""; + my $lc = $stat =~ tr@\n@@; + $lc = $lc + $linenr; + for (my $count = $linenr; $count <= $lc; $count++) { + my $fmt = get_quoted_string($lines[$count - 1], raw_line($count, 0)); + $fmt =~ s/%%//g; + if ($fmt =~ /(\%[\*\d\.]*p(?![\WFfSsBKRraEhMmIiUDdgVCbGN]).)/) { + $bad_extension = $1; + last; + } + } + if ($bad_extension ne "") { + my $stat_real = raw_line($linenr, 0); + for (my $count = $linenr + 1; $count <= $lc; $count++) { + $stat_real = $stat_real . "\n" . raw_line($count, 0); + } + WARN("VSPRINTF_POINTER_EXTENSION", + "Invalid vsprintf pointer extension '$bad_extension'\n" . "$here\n$stat_real\n"); + } + } + # Check for misused memsets if ($^V && $^V ge 5.10.0 && defined $stat && -- 2.10.0.rc2.1.g053435c