[PATCH 1/2] vsprintf: Prevent crash when dereferencing invalid pointers for %pD

[PATCH 1/2] vsprintf: Prevent crash when dereferencing invalid pointers for %pD

[Jia He]

Commit 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid
pointers") prevents most crash except for %pD.
There is an additional pointer dereferencing before dentry_name.

At least, vma->file can be NULL and be passed to printk %pD in 
print_bad_pte, which can cause crash.

This patch fixes it with introducing a new file_dentry_name.

Signed-off-by: Jia He <justin.he@arm.com>
---
 lib/vsprintf.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 63937044c57d..b4a119176fdb 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -869,6 +869,15 @@ char *dentry_name(char *buf, char *end, const struct dentry *d, struct printf_sp
 	return widen_string(buf, n, end, spec);
 }
 
+static noinline_for_stack
+char *file_dentry_name(char *buf, char *end, const struct file *f,
+			struct printf_spec spec, const char *fmt)
+{
+	if (check_pointer(&buf, end, f, spec))
+		return buf;
+
+	return dentry_name(buf, end, f->f_path.dentry, spec, fmt);
+}
 #ifdef CONFIG_BLOCK
 static noinline_for_stack
 char *bdev_name(char *buf, char *end, struct block_device *bdev,
@@ -2166,9 +2175,7 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
 	case 'C':
 		return clock(buf, end, ptr, spec, fmt);
 	case 'D':
-		return dentry_name(buf, end,
-				   ((const struct file *)ptr)->f_path.dentry,
-				   spec, fmt);
+		return file_dentry_name(buf, end, ptr, spec, fmt);
 #ifdef CONFIG_BLOCK
 	case 'g':
 		return bdev_name(buf, end, ptr, spec, fmt);
-- 
2.17.1

[PATCH 2/2] lib/test_printf: add test of null/invalid pointer dereference for dentry

[Jia He]

This add some additional test cases of null/invalid pointer dereference
for dentry and file (%pd and %pD)

Signed-off-by: Jia He <justin.he@arm.com>
---
 lib/test_printf.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/test_printf.c b/lib/test_printf.c
index 944eb50f3862..befedffeb476 100644
--- a/lib/test_printf.c
+++ b/lib/test_printf.c
@@ -455,6 +455,13 @@ dentry(void)
 	test("foo", "%pd", &test_dentry[0]);
 	test("foo", "%pd2", &test_dentry[0]);
 
+	/* test the null/invalid pointer case for dentry */
+	test("(null)", "%pd", NULL);
+	test("(efault)", "%pd", PTR_INVALID);
+	/* test the null/invalid pointer case for file */
+	test("(null)", "%pD", NULL);
+	test("(efault)", "%pD", PTR_INVALID);
+
 	test("romeo", "%pd", &test_dentry[3]);
 	test("alfa/romeo", "%pd2", &test_dentry[3]);
 	test("bravo/alfa/romeo", "%pd3", &test_dentry[3]);
-- 
2.17.1

Re: [PATCH 2/2] lib/test_printf: add test of null/invalid pointer dereference for dentry

[Andy Shevchenko]

On Fri, Aug 9, 2019 at 4:28 AM Jia He <justin.he@arm.com> wrote:
>
> This add some additional test cases of null/invalid pointer dereference
> for dentry and file (%pd and %pD)
>

Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>

> Signed-off-by: Jia He <justin.he@arm.com>
> ---
>  lib/test_printf.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/lib/test_printf.c b/lib/test_printf.c
> index 944eb50f3862..befedffeb476 100644
> --- a/lib/test_printf.c
> +++ b/lib/test_printf.c
> @@ -455,6 +455,13 @@ dentry(void)
>         test("foo", "%pd", &test_dentry[0]);
>         test("foo", "%pd2", &test_dentry[0]);
>
> +       /* test the null/invalid pointer case for dentry */
> +       test("(null)", "%pd", NULL);
> +       test("(efault)", "%pd", PTR_INVALID);
> +       /* test the null/invalid pointer case for file */
> +       test("(null)", "%pD", NULL);
> +       test("(efault)", "%pD", PTR_INVALID);
> +
>         test("romeo", "%pd", &test_dentry[3]);
>         test("alfa/romeo", "%pd2", &test_dentry[3]);
>         test("bravo/alfa/romeo", "%pd3", &test_dentry[3]);
> --
> 2.17.1
>


-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 2/2] lib/test_printf: add test of null/invalid pointer dereference for dentry

[Petr Mladek]

On Fri 2019-08-09 09:24:57, Jia He wrote:
> This add some additional test cases of null/invalid pointer dereference
> for dentry and file (%pd and %pD)
> 
> Signed-off-by: Jia He <justin.he@arm.com>
> ---
>  lib/test_printf.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/lib/test_printf.c b/lib/test_printf.c
> index 944eb50f3862..befedffeb476 100644
> --- a/lib/test_printf.c
> +++ b/lib/test_printf.c
> @@ -455,6 +455,13 @@ dentry(void)
>  	test("foo", "%pd", &test_dentry[0]);
>  	test("foo", "%pd2", &test_dentry[0]);
>  
> +	/* test the null/invalid pointer case for dentry */
> +	test("(null)", "%pd", NULL);
> +	test("(efault)", "%pd", PTR_INVALID);
> +	/* test the null/invalid pointer case for file */

The two comments mention something that is obvious from the code.

I have pushed the patch as is and removed the comments in
a follow up patch [1]. Both are in printk.git, branch for-5.4.

> +	test("(null)", "%pD", NULL);
> +	test("(efault)", "%pD", PTR_INVALID);

Reference:
[1] https://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk.git/commit/?h=for-5.4&id=8ebea6ea1a7ed5d67ecbb2a493c716a2a89c0be2

Best Regards,
Petr

RE: [PATCH 2/2] lib/test_printf: add test of null/invalid pointer dereference for dentry

[Justin He (Arm Technology China)]

Hi Petr

> -----Original Message-----
> From: Petr Mladek <pmladek@suse.com>
> Sent: 2019年8月16日 16:27
> To: Justin He (Arm Technology China) <Justin.He@arm.com>
> Cc: Geert Uytterhoeven <geert+renesas@glider.be>; Sergey Senozhatsky
> <sergey.senozhatsky@gmail.com>; Thomas Gleixner <tglx@linutronix.de>;
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>; linux-
> kernel@vger.kernel.org; Kees Cook <keescook@chromium.org>; Steven
> Rostedt (VMware) <rostedt@goodmis.org>; Shuah Khan
> <shuah@kernel.org>; Tobin C. Harding <tobin@kernel.org>
> Subject: Re: [PATCH 2/2] lib/test_printf: add test of null/invalid pointer
> dereference for dentry
>
> On Fri 2019-08-09 09:24:57, Jia He wrote:
> > This add some additional test cases of null/invalid pointer dereference
> > for dentry and file (%pd and %pD)
> >
> > Signed-off-by: Jia He <justin.he@arm.com>
> > ---
> >  lib/test_printf.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/lib/test_printf.c b/lib/test_printf.c
> > index 944eb50f3862..befedffeb476 100644
> > --- a/lib/test_printf.c
> > +++ b/lib/test_printf.c
> > @@ -455,6 +455,13 @@ dentry(void)
> >     test("foo", "%pd", &test_dentry[0]);
> >     test("foo", "%pd2", &test_dentry[0]);
> >
> > +   /* test the null/invalid pointer case for dentry */
> > +   test("(null)", "%pd", NULL);
> > +   test("(efault)", "%pd", PTR_INVALID);
> > +   /* test the null/invalid pointer case for file */
>
> The two comments mention something that is obvious from the code.
>
No problem, ok with me 😊


--
Cheers,
Justin (Jia He)


> I have pushed the patch as is and removed the comments in
> a follow up patch [1]. Both are in printk.git, branch for-5.4.
>
> > +   test("(null)", "%pD", NULL);
> > +   test("(efault)", "%pD", PTR_INVALID);
>
> Reference:
> [1]
> https://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk.git/commi
> t/?h=for-5.4&id=8ebea6ea1a7ed5d67ecbb2a493c716a2a89c0be2
>
> Best Regards,
> Petr
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

Re: [PATCH 1/2] vsprintf: Prevent crash when dereferencing invalid pointers for %pD

[Andy Shevchenko]

On Fri, Aug 9, 2019 at 4:28 AM Jia He <justin.he@arm.com> wrote:
>
> Commit 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid
> pointers") prevents most crash except for %pD.
> There is an additional pointer dereferencing before dentry_name.
>
> At least, vma->file can be NULL and be passed to printk %pD in
> print_bad_pte, which can cause crash.
>
> This patch fixes it with introducing a new file_dentry_name.
>

Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>

Perhaps you need to add a Fixes tag

> Signed-off-by: Jia He <justin.he@arm.com>
> ---
>  lib/vsprintf.c | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> index 63937044c57d..b4a119176fdb 100644
> --- a/lib/vsprintf.c
> +++ b/lib/vsprintf.c
> @@ -869,6 +869,15 @@ char *dentry_name(char *buf, char *end, const struct dentry *d, struct printf_sp
>         return widen_string(buf, n, end, spec);
>  }
>
> +static noinline_for_stack
> +char *file_dentry_name(char *buf, char *end, const struct file *f,
> +                       struct printf_spec spec, const char *fmt)
> +{
> +       if (check_pointer(&buf, end, f, spec))
> +               return buf;
> +
> +       return dentry_name(buf, end, f->f_path.dentry, spec, fmt);
> +}
>  #ifdef CONFIG_BLOCK
>  static noinline_for_stack
>  char *bdev_name(char *buf, char *end, struct block_device *bdev,
> @@ -2166,9 +2175,7 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
>         case 'C':
>                 return clock(buf, end, ptr, spec, fmt);
>         case 'D':
> -               return dentry_name(buf, end,
> -                                  ((const struct file *)ptr)->f_path.dentry,
> -                                  spec, fmt);
> +               return file_dentry_name(buf, end, ptr, spec, fmt);
>  #ifdef CONFIG_BLOCK
>         case 'g':
>                 return bdev_name(buf, end, ptr, spec, fmt);
> --
> 2.17.1
>


-- 
With Best Regards,
Andy Shevchenko

RE: [PATCH 1/2] vsprintf: Prevent crash when dereferencing invalid pointers for %pD

[Justin He (Arm Technology China)]

> -----Original Message-----
> From: Andy Shevchenko <andy.shevchenko@gmail.com>
> Sent: 2019年8月9日 18:52
> To: Justin He (Arm Technology China) <Justin.He@arm.com>
> Cc: Petr Mladek <pmladek@suse.com>; Andy Shevchenko
> <andriy.shevchenko@linux.intel.com>; Sergey Senozhatsky
> <sergey.senozhatsky@gmail.com>; Geert Uytterhoeven
> <geert+renesas@glider.be>; Linux Kernel Mailing List <linux-
> kernel@vger.kernel.org>; Thomas Gleixner <tglx@linutronix.de>; Steven
> Rostedt (VMware) <rostedt@goodmis.org>; Kees Cook
> <keescook@chromium.org>; Shuah Khan <shuah@kernel.org>; Tobin C.
> Harding <tobin@kernel.org>
> Subject: Re: [PATCH 1/2] vsprintf: Prevent crash when dereferencing invalid
> pointers for %pD
>
> On Fri, Aug 9, 2019 at 4:28 AM Jia He <justin.he@arm.com> wrote:
> >
> > Commit 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing
> invalid
> > pointers") prevents most crash except for %pD.
> > There is an additional pointer dereferencing before dentry_name.
> >
> > At least, vma->file can be NULL and be passed to printk %pD in
> > print_bad_pte, which can cause crash.
> >
> > This patch fixes it with introducing a new file_dentry_name.
> >
>
> Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
>
> Perhaps you need to add a Fixes tag
Thanks, Andy
Fixes: 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid pointers")

Need I reposted v2?


--
Cheers,
Justin (Jia He)


>
> > Signed-off-by: Jia He <justin.he@arm.com>
> > ---
> >  lib/vsprintf.c | 13 ++++++++++---
> >  1 file changed, 10 insertions(+), 3 deletions(-)
> >
> > diff --git a/lib/vsprintf.c b/lib/vsprintf.c
> > index 63937044c57d..b4a119176fdb 100644
> > --- a/lib/vsprintf.c
> > +++ b/lib/vsprintf.c
> > @@ -869,6 +869,15 @@ char *dentry_name(char *buf, char *end, const
> struct dentry *d, struct printf_sp
> >         return widen_string(buf, n, end, spec);
> >  }
> >
> > +static noinline_for_stack
> > +char *file_dentry_name(char *buf, char *end, const struct file *f,
> > +                       struct printf_spec spec, const char *fmt)
> > +{
> > +       if (check_pointer(&buf, end, f, spec))
> > +               return buf;
> > +
> > +       return dentry_name(buf, end, f->f_path.dentry, spec, fmt);
> > +}
> >  #ifdef CONFIG_BLOCK
> >  static noinline_for_stack
> >  char *bdev_name(char *buf, char *end, struct block_device *bdev,
> > @@ -2166,9 +2175,7 @@ char *pointer(const char *fmt, char *buf, char
> *end, void *ptr,
> >         case 'C':
> >                 return clock(buf, end, ptr, spec, fmt);
> >         case 'D':
> > -               return dentry_name(buf, end,
> > -                                  ((const struct file *)ptr)->f_path.dentry,
> > -                                  spec, fmt);
> > +               return file_dentry_name(buf, end, ptr, spec, fmt);
> >  #ifdef CONFIG_BLOCK
> >         case 'g':
> >                 return bdev_name(buf, end, ptr, spec, fmt);
> > --
> > 2.17.1
> >
>
>
> --
> With Best Regards,
> Andy Shevchenko
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

Re: [PATCH 1/2] vsprintf: Prevent crash when dereferencing invalid pointers for %pD

[Petr Mladek]

On Fri 2019-08-09 10:56:04,  Justin He (Arm Technology China)  wrote:
> 
> 
> > -----Original Message-----
> > From: Andy Shevchenko <andy.shevchenko@gmail.com>
> > Sent: 2019年8月9日 18:52
> > To: Justin He (Arm Technology China) <Justin.He@arm.com>
> > Cc: Petr Mladek <pmladek@suse.com>; Andy Shevchenko
> > <andriy.shevchenko@linux.intel.com>; Sergey Senozhatsky
> > <sergey.senozhatsky@gmail.com>; Geert Uytterhoeven
> > <geert+renesas@glider.be>; Linux Kernel Mailing List <linux-
> > kernel@vger.kernel.org>; Thomas Gleixner <tglx@linutronix.de>; Steven
> > Rostedt (VMware) <rostedt@goodmis.org>; Kees Cook
> > <keescook@chromium.org>; Shuah Khan <shuah@kernel.org>; Tobin C.
> > Harding <tobin@kernel.org>
> > Subject: Re: [PATCH 1/2] vsprintf: Prevent crash when dereferencing invalid
> > pointers for %pD
> >
> > On Fri, Aug 9, 2019 at 4:28 AM Jia He <justin.he@arm.com> wrote:
> > >
> > > Commit 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing
> > invalid
> > > pointers") prevents most crash except for %pD.
> > > There is an additional pointer dereferencing before dentry_name.
> > >
> > > At least, vma->file can be NULL and be passed to printk %pD in
> > > print_bad_pte, which can cause crash.
> > >
> > > This patch fixes it with introducing a new file_dentry_name.
> > >
> >
> > Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
> >
> > Perhaps you need to add a Fixes tag
> Thanks, Andy
> Fixes: 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid pointers")

I have added the Fixes tag and pushed the patch into printk.git,
branch for-5.4.

Thanks for the fix.

Best Regards,
Petr

Re: [PATCH 1/2] vsprintf: Prevent crash when dereferencing invalid pointers for %pD

[Sergey Senozhatsky]

On (08/09/19 09:24), Jia He wrote:
> Commit 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid
> pointers") prevents most crash except for %pD.
> There is an additional pointer dereferencing before dentry_name.
> 
> At least, vma->file can be NULL and be passed to printk %pD in 
> print_bad_pte, which can cause crash.
> 
> This patch fixes it with introducing a new file_dentry_name.
> 
> Signed-off-by: Jia He <justin.he@arm.com>

The series looks OK to me.

FWIW,
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>

	-ss