From patchwork Mon Nov 27 22:30:18 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tobin Harding X-Patchwork-Id: 10078293 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A42AE602BD for ; Mon, 27 Nov 2017 22:31:00 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9796528FCF for ; Mon, 27 Nov 2017 22:31:00 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8B6DC290B8; Mon, 27 Nov 2017 22:31:00 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id AD96528FCF for ; Mon, 27 Nov 2017 22:30:59 +0000 (UTC) Received: (qmail 12212 invoked by uid 550); 27 Nov 2017 22:30:55 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 12074 invoked from network); 27 Nov 2017 22:30:54 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tobin.cc; h=cc :date:from:in-reply-to:message-id:references:subject:to :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=XXbEgZ2/O7z/kk5sH ozJvTLzg6koKJS5QWQqvl0NCl0=; b=enYpOJqIpPTToCHgXPqTNmQIqDvCzWPfl hFFNY+NJkAZBS31tSwVZqg/mTsg7cmE954wEeuMsq7w59sw+tzska2jqdhjKj4za QzMdyJt4qHnda3S1TtrcOSjweoykBqMBUg3ZP3us6F0NMHaWYYz0jzU3ijZ1aPbv eSLsHWK+rYvcDMN+khxO58euV62oO4apzkEV323vW0ClSLZANnLeiE1+O6JhZsNi 2EhealQPpeCW8lqPnkcK1xjbXvcd/A+DTYo8frVBOYR9C0s9wyjQhOV6swcVer6q MS53Nv9noAdUGD0RvFKRR8gk3Shd/Qu/kGajkyA5gOcR7xaYJ6Mew== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:date:from:in-reply-to:message-id :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= fm1; bh=XXbEgZ2/O7z/kk5sHozJvTLzg6koKJS5QWQqvl0NCl0=; b=F+PZ4eLL ul2uyVJ0ecxbw1r+KNfII+7Ec7dTyRiqddzsali5hD7BLXfb12eq7jMmqGYEkhcy rCRQhmlXEg1qEje9D1X6QV3+QDP8bDhvPDTl1zAkN+9oYHpDZ1HPbBqCgqNuxoq/ ZO5cpY5IO8tgATdTyi/pWWaVaVeWD1LxVb8XKmiY0aDKucWPPnbBeoSZnVhatu1B ZMKFGItaI3yqkV4flzOPgMeVQxJLQTUiWzqrmdDEUB52gV5Wrtm1cmlCegtytd7O w4P/4D6MKJln4kAToXBF+bXGM91DnHyg75/pW0oK6q2VZoik+qwOSIu8w66/OKid 8UBzpyRPOQl0dA== X-ME-Sender: From: "Tobin C. Harding" To: kernel-hardening@lists.openwall.com Cc: "Tobin C. Harding" , linux-kernel@vger.kernel.org, Network Development , Steven Rostedt , Tycho Andersen , Andrew Morton , Ingo Molnar , Kees Cook , Thomas Gleixner , Petr Mladek , Baoquan He , Krzysztof Kozlowski , Greg Kroah-Hartman , Randy Dunlap , Ian Abbott , =?UTF-8?q?Niklas=20S=C3=B6derlund?= , Masahiro Yamada , Larry Finger , Andy Shevchenko , Joe Perches , William Roberts , Rob Herring , Mark Rutland , Pantelis Antoniou , Alexey Dobriyan , Mauro Carvalho Chehab Date: Tue, 28 Nov 2017 09:30:18 +1100 Message-Id: <1511821819-5496-3-git-send-email-me@tobin.cc> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1511821819-5496-1-git-send-email-me@tobin.cc> References: <1511821819-5496-1-git-send-email-me@tobin.cc> Subject: [kernel-hardening] [RFC 2/3] vsprintf: print if symbol not found X-Virus-Scanned: ClamAV using ClamSMTP Depends on: commit bd6b239cdbb2 ("kallsyms: don't leak address when symbol not found") Currently vsprintf for specifiers %p[SsB] relies on the behaviour of kallsyms (sprint_symbol()) and prints the actual address if a symbol is not found. Previous patch changes this behaviour so tha sprint_symbol() returns an error if symbol not found. With this patch in place we can print a sanitized message '' instead of leaking the address. Future users of vsprintf may wish to know, after a call that uses specifier %p[sSB], whether or not a symbol was found. The actual sanitized string should be contained (isolated) within the vsprintf.c therefore we should provide a predicate function. This also allows the sanitized string to be updated at a later stage with minimal risk to calling code. Print '' for printk specifier %s[sSB] if no symbol is found. Provide predicate function string_is_no_symbol(). Signed-off-by: Tobin C. Harding --- include/linux/kernel.h | 2 ++ lib/vsprintf.c | 18 +++++++++++++++--- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/include/linux/kernel.h b/include/linux/kernel.h index ce51455e2adf..89e8ce79c2d1 100644 --- a/include/linux/kernel.h +++ b/include/linux/kernel.h @@ -460,6 +460,8 @@ char *kvasprintf(gfp_t gfp, const char *fmt, va_list args); extern __printf(2, 0) const char *kvasprintf_const(gfp_t gfp, const char *fmt, va_list args); +extern int string_is_no_symbol(const char *s); + extern __scanf(2, 3) int sscanf(const char *, const char *, ...); extern __scanf(2, 0) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 1746bae94d41..01e18a8c63fd 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -665,6 +665,8 @@ char *bdev_name(char *buf, char *end, struct block_device *bdev, } #endif +#define PRINTK_NO_SYMBOL_STR "" + static noinline_for_stack char *symbol_string(char *buf, char *end, void *ptr, struct printf_spec spec, const char *fmt) @@ -672,6 +674,7 @@ char *symbol_string(char *buf, char *end, void *ptr, unsigned long value; #ifdef CONFIG_KALLSYMS char sym[KSYM_SYMBOL_LEN]; + int ret; #endif if (fmt[1] == 'R') @@ -680,11 +683,14 @@ char *symbol_string(char *buf, char *end, void *ptr, #ifdef CONFIG_KALLSYMS if (*fmt == 'B') - sprint_backtrace(sym, value); + ret = sprint_backtrace(sym, value); else if (*fmt != 'f' && *fmt != 's') - sprint_symbol(sym, value); + ret = sprint_symbol(sym, value); else - sprint_symbol_no_offset(sym, value); + ret = sprint_symbol_no_offset(sym, value); + + if (ret == -1) + strcpy(sym, PRINTK_NO_SYMBOL_STR); return string(buf, end, sym, spec); #else @@ -692,6 +698,12 @@ char *symbol_string(char *buf, char *end, void *ptr, #endif } +int string_is_no_symbol(const char *s) +{ + return !!strstr(s, PRINTK_NO_SYMBOL_STR); +} +EXPORT_SYMBOL(string_is_no_symbol); + static noinline_for_stack char *resource_string(char *buf, char *end, struct resource *res, struct printf_spec spec, const char *fmt)