2019-05-19 14:08:20 +02:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-only
|
2015-11-07 01:30:29 +01:00
|
|
|
/*
|
|
|
|
* Test cases for printf facility.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/printk.h>
|
|
|
|
#include <linux/random.h>
|
2018-12-04 22:23:11 +01:00
|
|
|
#include <linux/rtc.h>
|
2015-11-07 01:30:29 +01:00
|
|
|
#include <linux/slab.h>
|
|
|
|
#include <linux/string.h>
|
|
|
|
|
2016-01-16 01:59:06 +01:00
|
|
|
#include <linux/bitmap.h>
|
2016-01-16 01:59:09 +01:00
|
|
|
#include <linux/dcache.h>
|
2015-11-07 01:30:29 +01:00
|
|
|
#include <linux/socket.h>
|
|
|
|
#include <linux/in.h>
|
|
|
|
|
mm, printk: introduce new format string for flags
In mm we use several kinds of flags bitfields that are sometimes printed
for debugging purposes, or exported to userspace via sysfs. To make
them easier to interpret independently on kernel version and config, we
want to dump also the symbolic flag names. So far this has been done
with repeated calls to pr_cont(), which is unreliable on SMP, and not
usable for e.g. sysfs export.
To get a more reliable and universal solution, this patch extends
printk() format string for pointers to handle the page flags (%pGp),
gfp_flags (%pGg) and vma flags (%pGv). Existing users of
dump_flag_names() are converted and simplified.
It would be possible to pass flags by value instead of pointer, but the
%p format string for pointers already has extensions for various kernel
structures, so it's a good fit, and the extra indirection in a
non-critical path is negligible.
[linux@rasmusvillemoes.dk: lots of good implementation suggestions]
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-03-15 22:55:56 +01:00
|
|
|
#include <linux/gfp.h>
|
|
|
|
#include <linux/mm.h>
|
|
|
|
|
2019-04-05 03:58:57 +02:00
|
|
|
#include "../tools/testing/selftests/kselftest_module.h"
|
|
|
|
|
2015-11-07 01:30:29 +01:00
|
|
|
#define BUF_SIZE 256
|
2016-01-16 01:58:53 +01:00
|
|
|
#define PAD_SIZE 16
|
2015-11-07 01:30:29 +01:00
|
|
|
#define FILL_CHAR '$'
|
|
|
|
|
|
|
|
static unsigned total_tests __initdata;
|
|
|
|
static unsigned failed_tests __initdata;
|
|
|
|
static char *test_buffer __initdata;
|
2016-01-16 01:58:53 +01:00
|
|
|
static char *alloced_buffer __initdata;
|
2015-11-07 01:30:29 +01:00
|
|
|
|
|
|
|
static int __printf(4, 0) __init
|
|
|
|
do_test(int bufsize, const char *expect, int elen,
|
|
|
|
const char *fmt, va_list ap)
|
|
|
|
{
|
|
|
|
va_list aq;
|
|
|
|
int ret, written;
|
|
|
|
|
|
|
|
total_tests++;
|
|
|
|
|
2016-01-16 01:58:53 +01:00
|
|
|
memset(alloced_buffer, FILL_CHAR, BUF_SIZE + 2*PAD_SIZE);
|
2015-11-07 01:30:29 +01:00
|
|
|
va_copy(aq, ap);
|
|
|
|
ret = vsnprintf(test_buffer, bufsize, fmt, aq);
|
|
|
|
va_end(aq);
|
|
|
|
|
|
|
|
if (ret != elen) {
|
|
|
|
pr_warn("vsnprintf(buf, %d, \"%s\", ...) returned %d, expected %d\n",
|
|
|
|
bufsize, fmt, ret, elen);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2016-01-16 01:58:53 +01:00
|
|
|
if (memchr_inv(alloced_buffer, FILL_CHAR, PAD_SIZE)) {
|
|
|
|
pr_warn("vsnprintf(buf, %d, \"%s\", ...) wrote before buffer\n", bufsize, fmt);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2015-11-07 01:30:29 +01:00
|
|
|
if (!bufsize) {
|
2016-01-16 01:58:53 +01:00
|
|
|
if (memchr_inv(test_buffer, FILL_CHAR, BUF_SIZE + PAD_SIZE)) {
|
2015-11-07 01:30:29 +01:00
|
|
|
pr_warn("vsnprintf(buf, 0, \"%s\", ...) wrote to buffer\n",
|
|
|
|
fmt);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
written = min(bufsize-1, elen);
|
|
|
|
if (test_buffer[written]) {
|
|
|
|
pr_warn("vsnprintf(buf, %d, \"%s\", ...) did not nul-terminate buffer\n",
|
|
|
|
bufsize, fmt);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2016-01-16 01:58:53 +01:00
|
|
|
if (memchr_inv(test_buffer + written + 1, FILL_CHAR, BUF_SIZE + PAD_SIZE - (written + 1))) {
|
|
|
|
pr_warn("vsnprintf(buf, %d, \"%s\", ...) wrote beyond the nul-terminator\n",
|
|
|
|
bufsize, fmt);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2015-11-07 01:30:29 +01:00
|
|
|
if (memcmp(test_buffer, expect, written)) {
|
|
|
|
pr_warn("vsnprintf(buf, %d, \"%s\", ...) wrote '%s', expected '%.*s'\n",
|
|
|
|
bufsize, fmt, test_buffer, written, expect);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __printf(3, 4) __init
|
|
|
|
__test(const char *expect, int elen, const char *fmt, ...)
|
|
|
|
{
|
|
|
|
va_list ap;
|
|
|
|
int rand;
|
|
|
|
char *p;
|
|
|
|
|
2016-01-16 01:58:50 +01:00
|
|
|
if (elen >= BUF_SIZE) {
|
|
|
|
pr_err("error in test suite: expected output length %d too long. Format was '%s'.\n",
|
|
|
|
elen, fmt);
|
|
|
|
failed_tests++;
|
|
|
|
return;
|
|
|
|
}
|
2015-11-07 01:30:29 +01:00
|
|
|
|
|
|
|
va_start(ap, fmt);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Every fmt+args is subjected to four tests: Three where we
|
|
|
|
* tell vsnprintf varying buffer sizes (plenty, not quite
|
|
|
|
* enough and 0), and then we also test that kvasprintf would
|
|
|
|
* be able to print it as expected.
|
|
|
|
*/
|
|
|
|
failed_tests += do_test(BUF_SIZE, expect, elen, fmt, ap);
|
|
|
|
rand = 1 + prandom_u32_max(elen+1);
|
|
|
|
/* Since elen < BUF_SIZE, we have 1 <= rand <= BUF_SIZE. */
|
|
|
|
failed_tests += do_test(rand, expect, elen, fmt, ap);
|
|
|
|
failed_tests += do_test(0, expect, elen, fmt, ap);
|
|
|
|
|
|
|
|
p = kvasprintf(GFP_KERNEL, fmt, ap);
|
|
|
|
if (p) {
|
2016-01-16 01:59:02 +01:00
|
|
|
total_tests++;
|
2015-11-07 01:30:29 +01:00
|
|
|
if (memcmp(p, expect, elen+1)) {
|
|
|
|
pr_warn("kvasprintf(..., \"%s\", ...) returned '%s', expected '%s'\n",
|
|
|
|
fmt, p, expect);
|
|
|
|
failed_tests++;
|
|
|
|
}
|
|
|
|
kfree(p);
|
|
|
|
}
|
|
|
|
va_end(ap);
|
|
|
|
}
|
|
|
|
|
|
|
|
#define test(expect, fmt, ...) \
|
|
|
|
__test(expect, strlen(expect), fmt, ##__VA_ARGS__)
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
test_basic(void)
|
|
|
|
{
|
|
|
|
/* Work around annoying "warning: zero-length gnu_printf format string". */
|
|
|
|
char nul = '\0';
|
|
|
|
|
|
|
|
test("", &nul);
|
|
|
|
test("100%", "100%%");
|
|
|
|
test("xxx%yyy", "xxx%cyyy", '%');
|
|
|
|
__test("xxx\0yyy", 7, "xxx%cyyy", '\0');
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
test_number(void)
|
|
|
|
{
|
|
|
|
test("0x1234abcd ", "%#-12x", 0x1234abcd);
|
|
|
|
test(" 0x1234abcd", "%#12x", 0x1234abcd);
|
|
|
|
test("0|001| 12|+123| 1234|-123|-1234", "%d|%03d|%3d|%+d|% d|%+d|% d", 0, 1, 12, 123, 1234, -123, -1234);
|
2016-01-16 01:58:59 +01:00
|
|
|
test("0|1|1|128|255", "%hhu|%hhu|%hhu|%hhu|%hhu", 0, 1, 257, 128, -1);
|
|
|
|
test("0|1|1|-128|-1", "%hhd|%hhd|%hhd|%hhd|%hhd", 0, 1, 257, 128, -1);
|
|
|
|
test("2015122420151225", "%ho%ho%#ho", 1037, 5282, -11627);
|
|
|
|
/*
|
|
|
|
* POSIX/C99: »The result of converting zero with an explicit
|
|
|
|
* precision of zero shall be no characters.« Hence the output
|
|
|
|
* from the below test should really be "00|0||| ". However,
|
|
|
|
* the kernel's printf also produces a single 0 in that
|
|
|
|
* case. This test case simply documents the current
|
|
|
|
* behaviour.
|
|
|
|
*/
|
|
|
|
test("00|0|0|0|0", "%.2d|%.1d|%.0d|%.*d|%1.0d", 0, 0, 0, 0, 0, 0);
|
|
|
|
#ifndef __CHAR_UNSIGNED__
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Passing a 'char' to a %02x specifier doesn't do
|
|
|
|
* what was presumably the intention when char is
|
|
|
|
* signed and the value is negative. One must either &
|
|
|
|
* with 0xff or cast to u8.
|
|
|
|
*/
|
|
|
|
char val = -16;
|
|
|
|
test("0xfffffff0|0xf0|0xf0", "%#02x|%#02x|%#02x", val, val & 0xff, (u8)val);
|
|
|
|
}
|
|
|
|
#endif
|
2015-11-07 01:30:29 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
test_string(void)
|
|
|
|
{
|
|
|
|
test("", "%s%.0s", "", "123");
|
|
|
|
test("ABCD|abc|123", "%s|%.3s|%.*s", "ABCD", "abcdef", 3, "123456");
|
|
|
|
test("1 | 2|3 | 4|5 ", "%-3s|%3s|%-*s|%*s|%*s", "1", "2", 3, "3", 3, "4", -3, "5");
|
2016-01-16 01:58:56 +01:00
|
|
|
test("1234 ", "%-10.4s", "123456");
|
|
|
|
test(" 1234", "%10.4s", "123456");
|
2015-11-07 01:30:29 +01:00
|
|
|
/*
|
2016-01-16 01:58:56 +01:00
|
|
|
* POSIX and C99 say that a negative precision (which is only
|
|
|
|
* possible to pass via a * argument) should be treated as if
|
|
|
|
* the precision wasn't present, and that if the precision is
|
|
|
|
* omitted (as in %.s), the precision should be taken to be
|
|
|
|
* 0. However, the kernel's printf behave exactly opposite,
|
|
|
|
* treating a negative precision as 0 and treating an omitted
|
|
|
|
* precision specifier as if no precision was given.
|
|
|
|
*
|
|
|
|
* These test cases document the current behaviour; should
|
|
|
|
* anyone ever feel the need to follow the standards more
|
|
|
|
* closely, this can be revisited.
|
2015-11-07 01:30:29 +01:00
|
|
|
*/
|
2016-01-16 01:58:56 +01:00
|
|
|
test(" ", "%4.*s", -5, "123456");
|
|
|
|
test("123456", "%.s", "123456");
|
2015-11-07 01:30:29 +01:00
|
|
|
test("a||", "%.s|%.0s|%.*s", "a", "b", 0, "c");
|
|
|
|
test("a | | ", "%-3.s|%-3.0s|%-3.*s", "a", "b", 0, "c");
|
|
|
|
}
|
|
|
|
|
2017-11-01 05:32:23 +01:00
|
|
|
#define PLAIN_BUF_SIZE 64 /* leave some space so we don't oops */
|
|
|
|
|
|
|
|
#if BITS_PER_LONG == 64
|
|
|
|
|
|
|
|
#define PTR_WIDTH 16
|
2018-02-16 22:07:03 +01:00
|
|
|
#define PTR ((void *)0xffff0123456789abUL)
|
2017-11-01 05:32:23 +01:00
|
|
|
#define PTR_STR "ffff0123456789ab"
|
2018-06-13 19:18:40 +02:00
|
|
|
#define PTR_VAL_NO_CRNG "(____ptrval____)"
|
2017-11-01 05:32:23 +01:00
|
|
|
#define ZEROS "00000000" /* hex 32 zero bits */
|
vsprintf: don't obfuscate NULL and error pointers
commit 7bd57fbc4a4ddedc664cad0bbced1b469e24e921 upstream.
I don't see what security concern is addressed by obfuscating NULL
and IS_ERR() error pointers, printed with %p/%pK. Given the number
of sites where %p is used (over 10000) and the fact that NULL pointers
aren't uncommon, it probably wouldn't take long for an attacker to
find the hash that corresponds to 0. Although harder, the same goes
for most common error values, such as -1, -2, -11, -14, etc.
The NULL part actually fixes a regression: NULL pointers weren't
obfuscated until commit 3e5903eb9cff ("vsprintf: Prevent crash when
dereferencing invalid pointers") which went into 5.2. I'm tacking
the IS_ERR() part on here because error pointers won't leak kernel
addresses and printing them as pointers shouldn't be any different
from e.g. %d with PTR_ERR_OR_ZERO(). Obfuscating them just makes
debugging based on existing pr_debug and friends excruciating.
Note that the "always print 0's for %pK when kptr_restrict == 2"
behaviour which goes way back is left as is.
Example output with the patch applied:
ptr error-ptr NULL
%p: 0000000001f8cc5b fffffffffffffff2 0000000000000000
%pK, kptr = 0: 0000000001f8cc5b fffffffffffffff2 0000000000000000
%px: ffff888048c04020 fffffffffffffff2 0000000000000000
%pK, kptr = 1: ffff888048c04020 fffffffffffffff2 0000000000000000
%pK, kptr = 2: 0000000000000000 0000000000000000 0000000000000000
Fixes: 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid pointers")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-19 13:26:57 +02:00
|
|
|
#define ONES "ffffffff" /* hex 32 one bits */
|
2017-11-01 05:32:23 +01:00
|
|
|
|
|
|
|
static int __init
|
|
|
|
plain_format(void)
|
|
|
|
{
|
|
|
|
char buf[PLAIN_BUF_SIZE];
|
|
|
|
int nchars;
|
|
|
|
|
|
|
|
nchars = snprintf(buf, PLAIN_BUF_SIZE, "%p", PTR);
|
|
|
|
|
2018-06-13 19:18:40 +02:00
|
|
|
if (nchars != PTR_WIDTH)
|
|
|
|
return -1;
|
|
|
|
|
|
|
|
if (strncmp(buf, PTR_VAL_NO_CRNG, PTR_WIDTH) == 0) {
|
|
|
|
pr_warn("crng possibly not yet initialized. plain 'p' buffer contains \"%s\"",
|
|
|
|
PTR_VAL_NO_CRNG);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (strncmp(buf, ZEROS, strlen(ZEROS)) != 0)
|
2017-11-01 05:32:23 +01:00
|
|
|
return -1;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
#else
|
|
|
|
|
|
|
|
#define PTR_WIDTH 8
|
|
|
|
#define PTR ((void *)0x456789ab)
|
|
|
|
#define PTR_STR "456789ab"
|
2018-06-13 19:18:40 +02:00
|
|
|
#define PTR_VAL_NO_CRNG "(ptrval)"
|
vsprintf: Prevent crash when dereferencing invalid pointers
We already prevent crash when dereferencing some obviously broken
pointers. But the handling is not consistent. Sometimes we print "(null)"
only for pure NULL pointer, sometimes for pointers in the first
page and sometimes also for pointers in the last page (error codes).
Note that printk() call this code under logbuf_lock. Any recursive
printks are redirected to the printk_safe implementation and the messages
are stored into per-CPU buffers. These buffers might be eventually flushed
in printk_safe_flush_on_panic() but it is not guaranteed.
This patch adds a check using probe_kernel_read(). It is not a full-proof
test. But it should help to see the error message in 99% situations where
the kernel would silently crash otherwise.
Also it makes the error handling unified for "%s" and the many %p*
specifiers that need to read the data from a given address. We print:
+ (null) when accessing data on pure pure NULL address
+ (efault) when accessing data on an invalid address
It does not affect the %p* specifiers that just print the given address
in some form, namely %pF, %pf, %pS, %ps, %pB, %pK, %px, and plain %p.
Note that we print (efault) from security reasons. In fact, the real
address can be seen only by %px or eventually %pK.
Link: http://lkml.kernel.org/r/20190417115350.20479-9-pmladek@suse.com
To: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: "Tobin C . Harding" <me@tobin.cc>
Cc: Joe Perches <joe@perches.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Cc: linux-kernel@vger.kernel.org
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
2019-04-17 13:53:48 +02:00
|
|
|
#define ZEROS ""
|
vsprintf: don't obfuscate NULL and error pointers
commit 7bd57fbc4a4ddedc664cad0bbced1b469e24e921 upstream.
I don't see what security concern is addressed by obfuscating NULL
and IS_ERR() error pointers, printed with %p/%pK. Given the number
of sites where %p is used (over 10000) and the fact that NULL pointers
aren't uncommon, it probably wouldn't take long for an attacker to
find the hash that corresponds to 0. Although harder, the same goes
for most common error values, such as -1, -2, -11, -14, etc.
The NULL part actually fixes a regression: NULL pointers weren't
obfuscated until commit 3e5903eb9cff ("vsprintf: Prevent crash when
dereferencing invalid pointers") which went into 5.2. I'm tacking
the IS_ERR() part on here because error pointers won't leak kernel
addresses and printing them as pointers shouldn't be any different
from e.g. %d with PTR_ERR_OR_ZERO(). Obfuscating them just makes
debugging based on existing pr_debug and friends excruciating.
Note that the "always print 0's for %pK when kptr_restrict == 2"
behaviour which goes way back is left as is.
Example output with the patch applied:
ptr error-ptr NULL
%p: 0000000001f8cc5b fffffffffffffff2 0000000000000000
%pK, kptr = 0: 0000000001f8cc5b fffffffffffffff2 0000000000000000
%px: ffff888048c04020 fffffffffffffff2 0000000000000000
%pK, kptr = 1: ffff888048c04020 fffffffffffffff2 0000000000000000
%pK, kptr = 2: 0000000000000000 0000000000000000 0000000000000000
Fixes: 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid pointers")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-19 13:26:57 +02:00
|
|
|
#define ONES ""
|
2017-11-01 05:32:23 +01:00
|
|
|
|
|
|
|
static int __init
|
|
|
|
plain_format(void)
|
|
|
|
{
|
|
|
|
/* Format is implicitly tested for 32 bit machines by plain_hash() */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif /* BITS_PER_LONG == 64 */
|
|
|
|
|
|
|
|
static int __init
|
2018-12-04 22:23:11 +01:00
|
|
|
plain_hash_to_buffer(const void *p, char *buf, size_t len)
|
2017-11-01 05:32:23 +01:00
|
|
|
{
|
|
|
|
int nchars;
|
|
|
|
|
2018-12-04 22:23:11 +01:00
|
|
|
nchars = snprintf(buf, len, "%p", p);
|
2017-11-01 05:32:23 +01:00
|
|
|
|
2018-06-13 19:18:40 +02:00
|
|
|
if (nchars != PTR_WIDTH)
|
|
|
|
return -1;
|
|
|
|
|
|
|
|
if (strncmp(buf, PTR_VAL_NO_CRNG, PTR_WIDTH) == 0) {
|
|
|
|
pr_warn("crng possibly not yet initialized. plain 'p' buffer contains \"%s\"",
|
|
|
|
PTR_VAL_NO_CRNG);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2018-12-04 22:23:11 +01:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int __init
|
|
|
|
plain_hash(void)
|
|
|
|
{
|
|
|
|
char buf[PLAIN_BUF_SIZE];
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
ret = plain_hash_to_buffer(PTR, buf, PLAIN_BUF_SIZE);
|
|
|
|
if (ret)
|
|
|
|
return ret;
|
|
|
|
|
2018-06-13 19:18:40 +02:00
|
|
|
if (strncmp(buf, PTR_STR, PTR_WIDTH) == 0)
|
2017-11-01 05:32:23 +01:00
|
|
|
return -1;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* We can't use test() to test %p because we don't know what output to expect
|
|
|
|
* after an address is hashed.
|
|
|
|
*/
|
2015-11-07 01:30:29 +01:00
|
|
|
static void __init
|
|
|
|
plain(void)
|
|
|
|
{
|
2017-11-01 05:32:23 +01:00
|
|
|
int err;
|
2015-11-07 01:30:29 +01:00
|
|
|
|
2017-11-01 05:32:23 +01:00
|
|
|
err = plain_hash();
|
|
|
|
if (err) {
|
|
|
|
pr_warn("plain 'p' does not appear to be hashed\n");
|
|
|
|
failed_tests++;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
err = plain_format();
|
|
|
|
if (err) {
|
|
|
|
pr_warn("hashing plain 'p' has unexpected format\n");
|
|
|
|
failed_tests++;
|
|
|
|
}
|
2015-11-07 01:30:29 +01:00
|
|
|
}
|
|
|
|
|
2018-12-04 22:23:11 +01:00
|
|
|
static void __init
|
|
|
|
test_hashed(const char *fmt, const void *p)
|
|
|
|
{
|
|
|
|
char buf[PLAIN_BUF_SIZE];
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* No need to increase failed test counter since this is assumed
|
|
|
|
* to be called after plain().
|
|
|
|
*/
|
|
|
|
ret = plain_hash_to_buffer(p, buf, PLAIN_BUF_SIZE);
|
|
|
|
if (ret)
|
|
|
|
return;
|
|
|
|
|
|
|
|
test(buf, fmt, p);
|
|
|
|
}
|
|
|
|
|
vsprintf: don't obfuscate NULL and error pointers
commit 7bd57fbc4a4ddedc664cad0bbced1b469e24e921 upstream.
I don't see what security concern is addressed by obfuscating NULL
and IS_ERR() error pointers, printed with %p/%pK. Given the number
of sites where %p is used (over 10000) and the fact that NULL pointers
aren't uncommon, it probably wouldn't take long for an attacker to
find the hash that corresponds to 0. Although harder, the same goes
for most common error values, such as -1, -2, -11, -14, etc.
The NULL part actually fixes a regression: NULL pointers weren't
obfuscated until commit 3e5903eb9cff ("vsprintf: Prevent crash when
dereferencing invalid pointers") which went into 5.2. I'm tacking
the IS_ERR() part on here because error pointers won't leak kernel
addresses and printing them as pointers shouldn't be any different
from e.g. %d with PTR_ERR_OR_ZERO(). Obfuscating them just makes
debugging based on existing pr_debug and friends excruciating.
Note that the "always print 0's for %pK when kptr_restrict == 2"
behaviour which goes way back is left as is.
Example output with the patch applied:
ptr error-ptr NULL
%p: 0000000001f8cc5b fffffffffffffff2 0000000000000000
%pK, kptr = 0: 0000000001f8cc5b fffffffffffffff2 0000000000000000
%px: ffff888048c04020 fffffffffffffff2 0000000000000000
%pK, kptr = 1: ffff888048c04020 fffffffffffffff2 0000000000000000
%pK, kptr = 2: 0000000000000000 0000000000000000 0000000000000000
Fixes: 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid pointers")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-19 13:26:57 +02:00
|
|
|
/*
|
|
|
|
* NULL pointers aren't hashed.
|
|
|
|
*/
|
vsprintf: Prevent crash when dereferencing invalid pointers
We already prevent crash when dereferencing some obviously broken
pointers. But the handling is not consistent. Sometimes we print "(null)"
only for pure NULL pointer, sometimes for pointers in the first
page and sometimes also for pointers in the last page (error codes).
Note that printk() call this code under logbuf_lock. Any recursive
printks are redirected to the printk_safe implementation and the messages
are stored into per-CPU buffers. These buffers might be eventually flushed
in printk_safe_flush_on_panic() but it is not guaranteed.
This patch adds a check using probe_kernel_read(). It is not a full-proof
test. But it should help to see the error message in 99% situations where
the kernel would silently crash otherwise.
Also it makes the error handling unified for "%s" and the many %p*
specifiers that need to read the data from a given address. We print:
+ (null) when accessing data on pure pure NULL address
+ (efault) when accessing data on an invalid address
It does not affect the %p* specifiers that just print the given address
in some form, namely %pF, %pf, %pS, %ps, %pB, %pK, %px, and plain %p.
Note that we print (efault) from security reasons. In fact, the real
address can be seen only by %px or eventually %pK.
Link: http://lkml.kernel.org/r/20190417115350.20479-9-pmladek@suse.com
To: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: "Tobin C . Harding" <me@tobin.cc>
Cc: Joe Perches <joe@perches.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Cc: linux-kernel@vger.kernel.org
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
2019-04-17 13:53:48 +02:00
|
|
|
static void __init
|
|
|
|
null_pointer(void)
|
|
|
|
{
|
vsprintf: don't obfuscate NULL and error pointers
commit 7bd57fbc4a4ddedc664cad0bbced1b469e24e921 upstream.
I don't see what security concern is addressed by obfuscating NULL
and IS_ERR() error pointers, printed with %p/%pK. Given the number
of sites where %p is used (over 10000) and the fact that NULL pointers
aren't uncommon, it probably wouldn't take long for an attacker to
find the hash that corresponds to 0. Although harder, the same goes
for most common error values, such as -1, -2, -11, -14, etc.
The NULL part actually fixes a regression: NULL pointers weren't
obfuscated until commit 3e5903eb9cff ("vsprintf: Prevent crash when
dereferencing invalid pointers") which went into 5.2. I'm tacking
the IS_ERR() part on here because error pointers won't leak kernel
addresses and printing them as pointers shouldn't be any different
from e.g. %d with PTR_ERR_OR_ZERO(). Obfuscating them just makes
debugging based on existing pr_debug and friends excruciating.
Note that the "always print 0's for %pK when kptr_restrict == 2"
behaviour which goes way back is left as is.
Example output with the patch applied:
ptr error-ptr NULL
%p: 0000000001f8cc5b fffffffffffffff2 0000000000000000
%pK, kptr = 0: 0000000001f8cc5b fffffffffffffff2 0000000000000000
%px: ffff888048c04020 fffffffffffffff2 0000000000000000
%pK, kptr = 1: ffff888048c04020 fffffffffffffff2 0000000000000000
%pK, kptr = 2: 0000000000000000 0000000000000000 0000000000000000
Fixes: 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid pointers")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-19 13:26:57 +02:00
|
|
|
test(ZEROS "00000000", "%p", NULL);
|
vsprintf: Prevent crash when dereferencing invalid pointers
We already prevent crash when dereferencing some obviously broken
pointers. But the handling is not consistent. Sometimes we print "(null)"
only for pure NULL pointer, sometimes for pointers in the first
page and sometimes also for pointers in the last page (error codes).
Note that printk() call this code under logbuf_lock. Any recursive
printks are redirected to the printk_safe implementation and the messages
are stored into per-CPU buffers. These buffers might be eventually flushed
in printk_safe_flush_on_panic() but it is not guaranteed.
This patch adds a check using probe_kernel_read(). It is not a full-proof
test. But it should help to see the error message in 99% situations where
the kernel would silently crash otherwise.
Also it makes the error handling unified for "%s" and the many %p*
specifiers that need to read the data from a given address. We print:
+ (null) when accessing data on pure pure NULL address
+ (efault) when accessing data on an invalid address
It does not affect the %p* specifiers that just print the given address
in some form, namely %pF, %pf, %pS, %ps, %pB, %pK, %px, and plain %p.
Note that we print (efault) from security reasons. In fact, the real
address can be seen only by %px or eventually %pK.
Link: http://lkml.kernel.org/r/20190417115350.20479-9-pmladek@suse.com
To: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: "Tobin C . Harding" <me@tobin.cc>
Cc: Joe Perches <joe@perches.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Cc: linux-kernel@vger.kernel.org
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
2019-04-17 13:53:48 +02:00
|
|
|
test(ZEROS "00000000", "%px", NULL);
|
|
|
|
test("(null)", "%pE", NULL);
|
|
|
|
}
|
|
|
|
|
vsprintf: don't obfuscate NULL and error pointers
commit 7bd57fbc4a4ddedc664cad0bbced1b469e24e921 upstream.
I don't see what security concern is addressed by obfuscating NULL
and IS_ERR() error pointers, printed with %p/%pK. Given the number
of sites where %p is used (over 10000) and the fact that NULL pointers
aren't uncommon, it probably wouldn't take long for an attacker to
find the hash that corresponds to 0. Although harder, the same goes
for most common error values, such as -1, -2, -11, -14, etc.
The NULL part actually fixes a regression: NULL pointers weren't
obfuscated until commit 3e5903eb9cff ("vsprintf: Prevent crash when
dereferencing invalid pointers") which went into 5.2. I'm tacking
the IS_ERR() part on here because error pointers won't leak kernel
addresses and printing them as pointers shouldn't be any different
from e.g. %d with PTR_ERR_OR_ZERO(). Obfuscating them just makes
debugging based on existing pr_debug and friends excruciating.
Note that the "always print 0's for %pK when kptr_restrict == 2"
behaviour which goes way back is left as is.
Example output with the patch applied:
ptr error-ptr NULL
%p: 0000000001f8cc5b fffffffffffffff2 0000000000000000
%pK, kptr = 0: 0000000001f8cc5b fffffffffffffff2 0000000000000000
%px: ffff888048c04020 fffffffffffffff2 0000000000000000
%pK, kptr = 1: ffff888048c04020 fffffffffffffff2 0000000000000000
%pK, kptr = 2: 0000000000000000 0000000000000000 0000000000000000
Fixes: 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid pointers")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-19 13:26:57 +02:00
|
|
|
/*
|
|
|
|
* Error pointers aren't hashed.
|
|
|
|
*/
|
|
|
|
static void __init
|
|
|
|
error_pointer(void)
|
|
|
|
{
|
|
|
|
test(ONES "fffffff5", "%p", ERR_PTR(-11));
|
|
|
|
test(ONES "fffffff5", "%px", ERR_PTR(-11));
|
|
|
|
test("(efault)", "%pE", ERR_PTR(-11));
|
|
|
|
}
|
|
|
|
|
vsprintf: Prevent crash when dereferencing invalid pointers
We already prevent crash when dereferencing some obviously broken
pointers. But the handling is not consistent. Sometimes we print "(null)"
only for pure NULL pointer, sometimes for pointers in the first
page and sometimes also for pointers in the last page (error codes).
Note that printk() call this code under logbuf_lock. Any recursive
printks are redirected to the printk_safe implementation and the messages
are stored into per-CPU buffers. These buffers might be eventually flushed
in printk_safe_flush_on_panic() but it is not guaranteed.
This patch adds a check using probe_kernel_read(). It is not a full-proof
test. But it should help to see the error message in 99% situations where
the kernel would silently crash otherwise.
Also it makes the error handling unified for "%s" and the many %p*
specifiers that need to read the data from a given address. We print:
+ (null) when accessing data on pure pure NULL address
+ (efault) when accessing data on an invalid address
It does not affect the %p* specifiers that just print the given address
in some form, namely %pF, %pf, %pS, %ps, %pB, %pK, %px, and plain %p.
Note that we print (efault) from security reasons. In fact, the real
address can be seen only by %px or eventually %pK.
Link: http://lkml.kernel.org/r/20190417115350.20479-9-pmladek@suse.com
To: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: "Tobin C . Harding" <me@tobin.cc>
Cc: Joe Perches <joe@perches.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Cc: linux-kernel@vger.kernel.org
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
2019-04-17 13:53:48 +02:00
|
|
|
#define PTR_INVALID ((void *)0x000000ab)
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
invalid_pointer(void)
|
|
|
|
{
|
|
|
|
test_hashed("%p", PTR_INVALID);
|
|
|
|
test(ZEROS "000000ab", "%px", PTR_INVALID);
|
|
|
|
test("(efault)", "%pE", PTR_INVALID);
|
|
|
|
}
|
|
|
|
|
2015-11-07 01:30:29 +01:00
|
|
|
static void __init
|
|
|
|
symbol_ptr(void)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
kernel_ptr(void)
|
|
|
|
{
|
2017-11-01 05:32:23 +01:00
|
|
|
/* We can't test this without access to kptr_restrict. */
|
2015-11-07 01:30:29 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
struct_resource(void)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
addr(void)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
escaped_str(void)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
hex_string(void)
|
|
|
|
{
|
|
|
|
const char buf[3] = {0xc0, 0xff, 0xee};
|
|
|
|
|
|
|
|
test("c0 ff ee|c0:ff:ee|c0-ff-ee|c0ffee",
|
|
|
|
"%3ph|%3phC|%3phD|%3phN", buf, buf, buf, buf);
|
|
|
|
test("c0 ff ee|c0:ff:ee|c0-ff-ee|c0ffee",
|
|
|
|
"%*ph|%*phC|%*phD|%*phN", 3, buf, 3, buf, 3, buf, 3, buf);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
mac(void)
|
|
|
|
{
|
|
|
|
const u8 addr[6] = {0x2d, 0x48, 0xd6, 0xfc, 0x7a, 0x05};
|
|
|
|
|
|
|
|
test("2d:48:d6:fc:7a:05", "%pM", addr);
|
|
|
|
test("05:7a:fc:d6:48:2d", "%pMR", addr);
|
|
|
|
test("2d-48-d6-fc-7a-05", "%pMF", addr);
|
|
|
|
test("2d48d6fc7a05", "%pm", addr);
|
|
|
|
test("057afcd6482d", "%pmR", addr);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
ip4(void)
|
|
|
|
{
|
|
|
|
struct sockaddr_in sa;
|
|
|
|
|
|
|
|
sa.sin_family = AF_INET;
|
|
|
|
sa.sin_port = cpu_to_be16(12345);
|
|
|
|
sa.sin_addr.s_addr = cpu_to_be32(0x7f000001);
|
|
|
|
|
|
|
|
test("127.000.000.001|127.0.0.1", "%pi4|%pI4", &sa.sin_addr, &sa.sin_addr);
|
|
|
|
test("127.000.000.001|127.0.0.1", "%piS|%pIS", &sa, &sa);
|
|
|
|
sa.sin_addr.s_addr = cpu_to_be32(0x01020304);
|
|
|
|
test("001.002.003.004:12345|1.2.3.4:12345", "%piSp|%pISp", &sa, &sa);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
ip6(void)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
ip(void)
|
|
|
|
{
|
|
|
|
ip4();
|
|
|
|
ip6();
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
uuid(void)
|
|
|
|
{
|
|
|
|
const char uuid[16] = {0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7,
|
|
|
|
0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf};
|
|
|
|
|
|
|
|
test("00010203-0405-0607-0809-0a0b0c0d0e0f", "%pUb", uuid);
|
|
|
|
test("00010203-0405-0607-0809-0A0B0C0D0E0F", "%pUB", uuid);
|
|
|
|
test("03020100-0504-0706-0809-0a0b0c0d0e0f", "%pUl", uuid);
|
|
|
|
test("03020100-0504-0706-0809-0A0B0C0D0E0F", "%pUL", uuid);
|
|
|
|
}
|
|
|
|
|
2016-01-16 01:59:09 +01:00
|
|
|
static struct dentry test_dentry[4] __initdata = {
|
|
|
|
{ .d_parent = &test_dentry[0],
|
|
|
|
.d_name = QSTR_INIT(test_dentry[0].d_iname, 3),
|
|
|
|
.d_iname = "foo" },
|
|
|
|
{ .d_parent = &test_dentry[0],
|
|
|
|
.d_name = QSTR_INIT(test_dentry[1].d_iname, 5),
|
|
|
|
.d_iname = "bravo" },
|
|
|
|
{ .d_parent = &test_dentry[1],
|
|
|
|
.d_name = QSTR_INIT(test_dentry[2].d_iname, 4),
|
|
|
|
.d_iname = "alfa" },
|
|
|
|
{ .d_parent = &test_dentry[2],
|
|
|
|
.d_name = QSTR_INIT(test_dentry[3].d_iname, 5),
|
|
|
|
.d_iname = "romeo" },
|
|
|
|
};
|
|
|
|
|
2015-11-07 01:30:29 +01:00
|
|
|
static void __init
|
|
|
|
dentry(void)
|
|
|
|
{
|
2016-01-16 01:59:09 +01:00
|
|
|
test("foo", "%pd", &test_dentry[0]);
|
|
|
|
test("foo", "%pd2", &test_dentry[0]);
|
|
|
|
|
2019-08-09 03:24:57 +02:00
|
|
|
test("(null)", "%pd", NULL);
|
|
|
|
test("(efault)", "%pd", PTR_INVALID);
|
|
|
|
test("(null)", "%pD", NULL);
|
|
|
|
test("(efault)", "%pD", PTR_INVALID);
|
|
|
|
|
2016-01-16 01:59:09 +01:00
|
|
|
test("romeo", "%pd", &test_dentry[3]);
|
|
|
|
test("alfa/romeo", "%pd2", &test_dentry[3]);
|
|
|
|
test("bravo/alfa/romeo", "%pd3", &test_dentry[3]);
|
|
|
|
test("/bravo/alfa/romeo", "%pd4", &test_dentry[3]);
|
|
|
|
test("/bravo/alfa", "%pd4", &test_dentry[2]);
|
|
|
|
|
|
|
|
test("bravo/alfa |bravo/alfa ", "%-12pd2|%*pd2", &test_dentry[2], -12, &test_dentry[2]);
|
|
|
|
test(" bravo/alfa| bravo/alfa", "%12pd2|%*pd2", &test_dentry[2], 12, &test_dentry[2]);
|
2015-11-07 01:30:29 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
struct_va_format(void)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
2018-12-04 22:23:11 +01:00
|
|
|
static void __init
|
|
|
|
struct_rtc_time(void)
|
|
|
|
{
|
|
|
|
/* 1543210543 */
|
|
|
|
const struct rtc_time tm = {
|
|
|
|
.tm_sec = 43,
|
|
|
|
.tm_min = 35,
|
|
|
|
.tm_hour = 5,
|
|
|
|
.tm_mday = 26,
|
|
|
|
.tm_mon = 10,
|
|
|
|
.tm_year = 118,
|
|
|
|
};
|
|
|
|
|
2019-04-17 13:53:47 +02:00
|
|
|
test("(%ptR?)", "%pt", &tm);
|
2018-12-04 22:23:11 +01:00
|
|
|
test("2018-11-26T05:35:43", "%ptR", &tm);
|
|
|
|
test("0118-10-26T05:35:43", "%ptRr", &tm);
|
|
|
|
test("05:35:43|2018-11-26", "%ptRt|%ptRd", &tm, &tm);
|
|
|
|
test("05:35:43|0118-10-26", "%ptRtr|%ptRdr", &tm, &tm);
|
|
|
|
test("05:35:43|2018-11-26", "%ptRttr|%ptRdtr", &tm, &tm);
|
|
|
|
test("05:35:43 tr|2018-11-26 tr", "%ptRt tr|%ptRd tr", &tm, &tm);
|
|
|
|
}
|
|
|
|
|
2015-11-07 01:30:29 +01:00
|
|
|
static void __init
|
|
|
|
struct_clk(void)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
2016-01-16 01:59:06 +01:00
|
|
|
static void __init
|
|
|
|
large_bitmap(void)
|
|
|
|
{
|
|
|
|
const int nbits = 1 << 16;
|
2019-03-04 11:00:09 +01:00
|
|
|
unsigned long *bits = bitmap_zalloc(nbits, GFP_KERNEL);
|
2016-01-16 01:59:06 +01:00
|
|
|
if (!bits)
|
|
|
|
return;
|
|
|
|
|
|
|
|
bitmap_set(bits, 1, 20);
|
|
|
|
bitmap_set(bits, 60000, 15);
|
|
|
|
test("1-20,60000-60014", "%*pbl", nbits, bits);
|
2019-03-04 11:00:09 +01:00
|
|
|
bitmap_free(bits);
|
2016-01-16 01:59:06 +01:00
|
|
|
}
|
|
|
|
|
2015-11-07 01:30:29 +01:00
|
|
|
static void __init
|
|
|
|
bitmap(void)
|
|
|
|
{
|
|
|
|
DECLARE_BITMAP(bits, 20);
|
|
|
|
const int primes[] = {2,3,5,7,11,13,17,19};
|
|
|
|
int i;
|
|
|
|
|
|
|
|
bitmap_zero(bits, 20);
|
|
|
|
test("00000|00000", "%20pb|%*pb", bits, 20, bits);
|
|
|
|
test("|", "%20pbl|%*pbl", bits, 20, bits);
|
|
|
|
|
|
|
|
for (i = 0; i < ARRAY_SIZE(primes); ++i)
|
|
|
|
set_bit(primes[i], bits);
|
|
|
|
test("a28ac|a28ac", "%20pb|%*pb", bits, 20, bits);
|
|
|
|
test("2-3,5,7,11,13,17,19|2-3,5,7,11,13,17,19", "%20pbl|%*pbl", bits, 20, bits);
|
|
|
|
|
|
|
|
bitmap_fill(bits, 20);
|
|
|
|
test("fffff|fffff", "%20pb|%*pb", bits, 20, bits);
|
|
|
|
test("0-19|0-19", "%20pbl|%*pbl", bits, 20, bits);
|
2016-01-16 01:59:06 +01:00
|
|
|
|
|
|
|
large_bitmap();
|
2015-11-07 01:30:29 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
static void __init
|
|
|
|
netdev_features(void)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
mm, printk: introduce new format string for flags
In mm we use several kinds of flags bitfields that are sometimes printed
for debugging purposes, or exported to userspace via sysfs. To make
them easier to interpret independently on kernel version and config, we
want to dump also the symbolic flag names. So far this has been done
with repeated calls to pr_cont(), which is unreliable on SMP, and not
usable for e.g. sysfs export.
To get a more reliable and universal solution, this patch extends
printk() format string for pointers to handle the page flags (%pGp),
gfp_flags (%pGg) and vma flags (%pGv). Existing users of
dump_flag_names() are converted and simplified.
It would be possible to pass flags by value instead of pointer, but the
%p format string for pointers already has extensions for various kernel
structures, so it's a good fit, and the extra indirection in a
non-critical path is negligible.
[linux@rasmusvillemoes.dk: lots of good implementation suggestions]
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-03-15 22:55:56 +01:00
|
|
|
static void __init
|
|
|
|
flags(void)
|
|
|
|
{
|
|
|
|
unsigned long flags;
|
|
|
|
gfp_t gfp;
|
|
|
|
char *cmp_buffer;
|
|
|
|
|
|
|
|
flags = 0;
|
|
|
|
test("", "%pGp", &flags);
|
|
|
|
|
|
|
|
/* Page flags should filter the zone id */
|
|
|
|
flags = 1UL << NR_PAGEFLAGS;
|
|
|
|
test("", "%pGp", &flags);
|
|
|
|
|
|
|
|
flags |= 1UL << PG_uptodate | 1UL << PG_dirty | 1UL << PG_lru
|
|
|
|
| 1UL << PG_active | 1UL << PG_swapbacked;
|
|
|
|
test("uptodate|dirty|lru|active|swapbacked", "%pGp", &flags);
|
|
|
|
|
|
|
|
|
|
|
|
flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC
|
|
|
|
| VM_DENYWRITE;
|
|
|
|
test("read|exec|mayread|maywrite|mayexec|denywrite", "%pGv", &flags);
|
|
|
|
|
|
|
|
gfp = GFP_TRANSHUGE;
|
|
|
|
test("GFP_TRANSHUGE", "%pGg", &gfp);
|
|
|
|
|
|
|
|
gfp = GFP_ATOMIC|__GFP_DMA;
|
|
|
|
test("GFP_ATOMIC|GFP_DMA", "%pGg", &gfp);
|
|
|
|
|
|
|
|
gfp = __GFP_ATOMIC;
|
|
|
|
test("__GFP_ATOMIC", "%pGg", &gfp);
|
|
|
|
|
|
|
|
cmp_buffer = kmalloc(BUF_SIZE, GFP_KERNEL);
|
|
|
|
if (!cmp_buffer)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/* Any flags not translated by the table should remain numeric */
|
|
|
|
gfp = ~__GFP_BITS_MASK;
|
|
|
|
snprintf(cmp_buffer, BUF_SIZE, "%#lx", (unsigned long) gfp);
|
|
|
|
test(cmp_buffer, "%pGg", &gfp);
|
|
|
|
|
|
|
|
snprintf(cmp_buffer, BUF_SIZE, "__GFP_ATOMIC|%#lx",
|
|
|
|
(unsigned long) gfp);
|
|
|
|
gfp |= __GFP_ATOMIC;
|
|
|
|
test(cmp_buffer, "%pGg", &gfp);
|
|
|
|
|
|
|
|
kfree(cmp_buffer);
|
|
|
|
}
|
|
|
|
|
2015-11-07 01:30:29 +01:00
|
|
|
static void __init
|
|
|
|
test_pointer(void)
|
|
|
|
{
|
|
|
|
plain();
|
vsprintf: Prevent crash when dereferencing invalid pointers
We already prevent crash when dereferencing some obviously broken
pointers. But the handling is not consistent. Sometimes we print "(null)"
only for pure NULL pointer, sometimes for pointers in the first
page and sometimes also for pointers in the last page (error codes).
Note that printk() call this code under logbuf_lock. Any recursive
printks are redirected to the printk_safe implementation and the messages
are stored into per-CPU buffers. These buffers might be eventually flushed
in printk_safe_flush_on_panic() but it is not guaranteed.
This patch adds a check using probe_kernel_read(). It is not a full-proof
test. But it should help to see the error message in 99% situations where
the kernel would silently crash otherwise.
Also it makes the error handling unified for "%s" and the many %p*
specifiers that need to read the data from a given address. We print:
+ (null) when accessing data on pure pure NULL address
+ (efault) when accessing data on an invalid address
It does not affect the %p* specifiers that just print the given address
in some form, namely %pF, %pf, %pS, %ps, %pB, %pK, %px, and plain %p.
Note that we print (efault) from security reasons. In fact, the real
address can be seen only by %px or eventually %pK.
Link: http://lkml.kernel.org/r/20190417115350.20479-9-pmladek@suse.com
To: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: "Tobin C . Harding" <me@tobin.cc>
Cc: Joe Perches <joe@perches.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Cc: linux-kernel@vger.kernel.org
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
2019-04-17 13:53:48 +02:00
|
|
|
null_pointer();
|
vsprintf: don't obfuscate NULL and error pointers
commit 7bd57fbc4a4ddedc664cad0bbced1b469e24e921 upstream.
I don't see what security concern is addressed by obfuscating NULL
and IS_ERR() error pointers, printed with %p/%pK. Given the number
of sites where %p is used (over 10000) and the fact that NULL pointers
aren't uncommon, it probably wouldn't take long for an attacker to
find the hash that corresponds to 0. Although harder, the same goes
for most common error values, such as -1, -2, -11, -14, etc.
The NULL part actually fixes a regression: NULL pointers weren't
obfuscated until commit 3e5903eb9cff ("vsprintf: Prevent crash when
dereferencing invalid pointers") which went into 5.2. I'm tacking
the IS_ERR() part on here because error pointers won't leak kernel
addresses and printing them as pointers shouldn't be any different
from e.g. %d with PTR_ERR_OR_ZERO(). Obfuscating them just makes
debugging based on existing pr_debug and friends excruciating.
Note that the "always print 0's for %pK when kptr_restrict == 2"
behaviour which goes way back is left as is.
Example output with the patch applied:
ptr error-ptr NULL
%p: 0000000001f8cc5b fffffffffffffff2 0000000000000000
%pK, kptr = 0: 0000000001f8cc5b fffffffffffffff2 0000000000000000
%px: ffff888048c04020 fffffffffffffff2 0000000000000000
%pK, kptr = 1: ffff888048c04020 fffffffffffffff2 0000000000000000
%pK, kptr = 2: 0000000000000000 0000000000000000 0000000000000000
Fixes: 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid pointers")
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-19 13:26:57 +02:00
|
|
|
error_pointer();
|
vsprintf: Prevent crash when dereferencing invalid pointers
We already prevent crash when dereferencing some obviously broken
pointers. But the handling is not consistent. Sometimes we print "(null)"
only for pure NULL pointer, sometimes for pointers in the first
page and sometimes also for pointers in the last page (error codes).
Note that printk() call this code under logbuf_lock. Any recursive
printks are redirected to the printk_safe implementation and the messages
are stored into per-CPU buffers. These buffers might be eventually flushed
in printk_safe_flush_on_panic() but it is not guaranteed.
This patch adds a check using probe_kernel_read(). It is not a full-proof
test. But it should help to see the error message in 99% situations where
the kernel would silently crash otherwise.
Also it makes the error handling unified for "%s" and the many %p*
specifiers that need to read the data from a given address. We print:
+ (null) when accessing data on pure pure NULL address
+ (efault) when accessing data on an invalid address
It does not affect the %p* specifiers that just print the given address
in some form, namely %pF, %pf, %pS, %ps, %pB, %pK, %px, and plain %p.
Note that we print (efault) from security reasons. In fact, the real
address can be seen only by %px or eventually %pK.
Link: http://lkml.kernel.org/r/20190417115350.20479-9-pmladek@suse.com
To: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: "Tobin C . Harding" <me@tobin.cc>
Cc: Joe Perches <joe@perches.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Cc: linux-kernel@vger.kernel.org
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
2019-04-17 13:53:48 +02:00
|
|
|
invalid_pointer();
|
2015-11-07 01:30:29 +01:00
|
|
|
symbol_ptr();
|
|
|
|
kernel_ptr();
|
|
|
|
struct_resource();
|
|
|
|
addr();
|
|
|
|
escaped_str();
|
|
|
|
hex_string();
|
|
|
|
mac();
|
|
|
|
ip();
|
|
|
|
uuid();
|
|
|
|
dentry();
|
|
|
|
struct_va_format();
|
2018-12-04 22:23:11 +01:00
|
|
|
struct_rtc_time();
|
2015-11-07 01:30:29 +01:00
|
|
|
struct_clk();
|
|
|
|
bitmap();
|
|
|
|
netdev_features();
|
mm, printk: introduce new format string for flags
In mm we use several kinds of flags bitfields that are sometimes printed
for debugging purposes, or exported to userspace via sysfs. To make
them easier to interpret independently on kernel version and config, we
want to dump also the symbolic flag names. So far this has been done
with repeated calls to pr_cont(), which is unreliable on SMP, and not
usable for e.g. sysfs export.
To get a more reliable and universal solution, this patch extends
printk() format string for pointers to handle the page flags (%pGp),
gfp_flags (%pGg) and vma flags (%pGv). Existing users of
dump_flag_names() are converted and simplified.
It would be possible to pass flags by value instead of pointer, but the
%p format string for pointers already has extensions for various kernel
structures, so it's a good fit, and the extra indirection in a
non-critical path is negligible.
[linux@rasmusvillemoes.dk: lots of good implementation suggestions]
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-03-15 22:55:56 +01:00
|
|
|
flags();
|
2015-11-07 01:30:29 +01:00
|
|
|
}
|
|
|
|
|
2019-04-05 03:58:57 +02:00
|
|
|
static void __init selftest(void)
|
2015-11-07 01:30:29 +01:00
|
|
|
{
|
2016-01-16 01:58:53 +01:00
|
|
|
alloced_buffer = kmalloc(BUF_SIZE + 2*PAD_SIZE, GFP_KERNEL);
|
|
|
|
if (!alloced_buffer)
|
2019-04-05 03:58:57 +02:00
|
|
|
return;
|
2016-01-16 01:58:53 +01:00
|
|
|
test_buffer = alloced_buffer + PAD_SIZE;
|
2015-11-07 01:30:29 +01:00
|
|
|
|
|
|
|
test_basic();
|
|
|
|
test_number();
|
|
|
|
test_string();
|
|
|
|
test_pointer();
|
|
|
|
|
2016-01-16 01:58:53 +01:00
|
|
|
kfree(alloced_buffer);
|
2015-11-07 01:30:29 +01:00
|
|
|
}
|
|
|
|
|
2019-04-05 03:58:57 +02:00
|
|
|
KSTM_MODULE_LOADERS(test_printf);
|
2015-11-07 01:30:29 +01:00
|
|
|
MODULE_AUTHOR("Rasmus Villemoes <linux@rasmusvillemoes.dk>");
|
|
|
|
MODULE_LICENSE("GPL");
|