From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5B2131C3C07 for ; Mon, 6 Jan 2025 22:25:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736202357; cv=none; b=iE0rsMb+DNkmnyG/Z93dWtQ2OAK9IFiNuAnNGg/1/p7705wiq3Mok82KFoGiV2F0XiWR1AQmQH7f+hZ3F8Ahohz5OlFIfnvWt7SEk5WteZ4KjXxWIw8CXuEc43TgmBsKQVt7NpbLsUuIRI4BzqwP8NZ602iPGcoyBzLn2R0O+nc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736202357; c=relaxed/simple; bh=9PrpHP1xkEKTqIfSEp45VR5jKvtsxZlkDQBA31wlVQY=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type; b=TLx70GILhu9xhncZmwMfdtySOKvVXMMs0swXdLJ8B+kFBBDYIqfrhDZz2G4VCXazc/8K8mCzTuqHw2hr9dcd7LAAd7WP268dzaPJijApfWYyrNtsvTKqx13u2480OUzIBcnhRhJ1isU4zsWIO6N7Q8sIhqfo4HQolCy/OvzPGzI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 170BBC4CED2; Mon, 6 Jan 2025 22:25:55 +0000 (UTC) Date: Mon, 6 Jan 2025 17:27:22 -0500 From: Steven Rostedt To: LKML Cc: Linus Torvalds , Andrew Morton , Petr Mladek , Andy Shevchenko , Rasmus Villemoes , Sergey Senozhatsky , Kees Cook Subject: [RFC][PATCH] printf: Harden accessing pointer dereference in vsprintf() Message-ID: <20250106172722.5b6032e5@gandalf.local.home> X-Mailer: Claws Mail 3.20.0git84 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit From: Steven Rostedt For extra safety from crashing the kernel, add a copy_from_kernel_nofault() in check_pointer_msg(). If it fails to read the memory, then return "(efault)". This isn't full proof, as the length of the pointer being read could possibly go into bad memory, but this should catch the majority of errors. Linus had suggested adding this kind of check[1]. This is a bit different than Linus's solution as it utilizes copy_from_kernel_nofault() and doesn't require calls to pagefault_disable() and extra labels. [1] https://lore.kernel.org/all/CAHk-=wh3cUC2a=yJv42HTjDLCp6VM+GTky+q65vV_Q33BeoxAg@mail.gmail.com/ Signed-off-by: Steven Rostedt (Google) --- lib/vsprintf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 9d3dac38a3f4..1a533f1174f0 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -695,12 +695,18 @@ static char *error_string(char *buf, char *end, const char *s, */ static const char *check_pointer_msg(const void *ptr) { + char ch; + if (!ptr) return "(null)"; if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr)) return "(efault)"; + /* Just test a single byte */ + if (copy_from_kernel_nofault(&ch, ptr, 1) < 0) + return "(efault)"; + return NULL; } -- 2.45.2