[RFC][PATCH] printf: Harden accessing pointer dereference in vsprintf()

[Steven Rostedt <rostedt@goodmis.org>]

From: Steven Rostedt <rostedt@goodmis.org>

For extra safety from crashing the kernel, add a
copy_from_kernel_nofault() in check_pointer_msg(). If it fails to read the
memory, then return "(efault)".

This isn't full proof, as the length of the pointer being read could
possibly go into bad memory, but this should catch the majority of errors.

Linus had suggested adding this kind of check[1]. This is a bit different
than Linus's solution as it utilizes copy_from_kernel_nofault() and doesn't
require calls to pagefault_disable() and extra labels.

[1] https://lore.kernel.org/all/CAHk-=wh3cUC2a=yJv42HTjDLCp6VM+GTky+q65vV_Q33BeoxAg@mail.gmail.com/

Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
---
 lib/vsprintf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 9d3dac38a3f4..1a533f1174f0 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -695,12 +695,18 @@ static char *error_string(char *buf, char *end, const char *s,
  */
 static const char *check_pointer_msg(const void *ptr)
 {
+	char ch;
+
 	if (!ptr)
 		return "(null)";
 
 	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
 		return "(efault)";
 
+	/* Just test a single byte */
+	if (copy_from_kernel_nofault(&ch, ptr, 1) < 0)
+		return "(efault)";
+
 	return NULL;
 }
 
-- 
2.45.2