From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752424AbdB1Pet convert rfc822-to-8bit (ORCPT <rfc822;w@1wt.eu>);
        Tue, 28 Feb 2017 10:34:49 -0500
Received: from mga09.intel.com ([134.134.136.24]:43564 "EHLO mga09.intel.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1752110AbdB1Peo (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 28 Feb 2017 10:34:44 -0500
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.35,220,1484035200"; 
   d="scan'208";a="62928036"
From: "Roberts, William C" <william.c.roberts@intel.com>
To: Joe Perches <joe@perches.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Andy Whitcroft <apw@canonical.com>
CC: "kernel-hardening@lists.openwall.com" 
        <kernel-hardening@lists.openwall.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH] checkpatch: Add ability to find bad uses of vsprintf
 %p<foo> extensions
Thread-Topic: [PATCH] checkpatch: Add ability to find bad uses of vsprintf
 %p<foo> extensions
Thread-Index: AQHSkTvgR4P0S1tAWUWd0Bs/jUoaF6F+jUNA
Date: Tue, 28 Feb 2017 15:34:41 +0000
Message-ID: <476DC76E7D1DF2438D32BFADF679FC562307CFC1@ORSMSX103.amr.corp.intel.com>
References: <476DC76E7D1DF2438D32BFADF679FC562307BAE6@ORSMSX103.amr.corp.intel.com>
 <163a690510e636a23187c0dc9caa09ddac6d4cde.1488228427.git.joe@perches.com>
In-Reply-To: <163a690510e636a23187c0dc9caa09ddac6d4cde.1488228427.git.joe@perches.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiMGMyYzc2ODMtZGUxOS00MjRlLThjNmEtNTk4MDQzODU2OTkyIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX0lDIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE1LjkuNi42IiwiVHJ1c3RlZExhYmVsSGFzaCI6IlNsSXArUlFqRDFOYXNKSU1XcTVoNXFRVEx3dXl4Y0taNzZ6NUNhekRMNXM9In0=
x-ctpclassification: CTP_IC
x-originating-ip: [10.22.254.138]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 8BIT
MIME-Version: 1.0
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org



> -----Original Message-----
> From: Joe Perches [mailto:joe@perches.com]
> Sent: Monday, February 27, 2017 12:55 PM
> To: Andrew Morton <akpm@linux-foundation.org>; Andy Whitcroft
> <apw@canonical.com>
> Cc: Roberts, William C <william.c.roberts@intel.com>; kernel-
> hardening@lists.openwall.com; linux-kernel@vger.kernel.org
> Subject: [PATCH] checkpatch: Add ability to find bad uses of vsprintf %p<foo>
> extensions
> 
> %pK was at least once misused at %pk in an out-of-tree module.
> This lead to some security concerns.  Add the ability to track single and multiple
> line statements for misuses of %p<foo>.
> 
> Signed-off-by: Joe Perches <joe@perches.com>

Acked-By: William Roberts <william.c.roberts@intel.com>

> ---
> 
> Andrew, this has gone back and forth a few times.
> 
> It's imperfect as a patch context with just a single function addition can be
> missed, but that's not new with $stat tests and just this patch.  Perhaps one day
> the $stat identification mechanism can be improved.
> 
> Until then, can you please apply this?  Thanks.
> 
>  scripts/checkpatch.pl | 26 ++++++++++++++++++++++++++
>  1 file changed, 26 insertions(+)
> 
> diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl index
> ad5ea5c545b2..9293b8a1c121 100755
> --- a/scripts/checkpatch.pl
> +++ b/scripts/checkpatch.pl
> @@ -5676,6 +5676,32 @@ sub process {
>  			}
>  		}
> 
> +		# check for vsprintf extension %p<foo> misuses
> +		if ($^V && $^V ge 5.10.0 &&
> +		    defined $stat &&
> +		    $stat =~ /^\+(?![^\{]*\{\s*).*\b(\w+)\s*\(.*$String\s*,/s &&
> +		    $1 !~ /^_*volatile_*$/) {
> +			my $bad_extension = "";
> +			my $lc = $stat =~ tr@\n@@;
> +			$lc = $lc + $linenr;
> +		        for (my $count = $linenr; $count <= $lc; $count++) {
> +				my $fmt = get_quoted_string($lines[$count - 1],
> raw_line($count, 0));
> +				$fmt =~ s/%%//g;
> +				if ($fmt =~
> /(\%[\*\d\.]*p(?![\WFfSsBKRraEhMmIiUDdgVCbGN]).)/) {
> +					$bad_extension = $1;
> +					last;
> +				}
> +			}
> +			if ($bad_extension ne "") {
> +				my $stat_real = raw_line($linenr, 0);
> +				for (my $count = $linenr + 1; $count <= $lc;
> $count++) {
> +					$stat_real = $stat_real . "\n" .
> raw_line($count, 0);
> +				}
> +				WARN("VSPRINTF_POINTER_EXTENSION",
> +				     "Invalid vsprintf pointer extension
> '$bad_extension'\n" . "$here\n$stat_real\n");
> +			}
> +		}
> +
>  # Check for misused memsets
>  		if ($^V && $^V ge 5.10.0 &&
>  		    defined $stat &&
> --
> 2.10.0.rc2.1.g053435c