| Message ID | d7cd39abc28f5e0e08faa8958f35cd929165084e.1643281806.git.christophe.leroy@csgroup.eu (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | vsprintf: Fix %pK with kptr_restrict == 0 | expand |
Adding Kees and Linus in Cc because it modifies %pK behavior. On Thu 2022-01-27 11:11:02, Christophe Leroy wrote: > Although kptr_restrict is set to 0 and the kernel is booted with > no_hash_pointers parameter, the content of /proc/vmallocinfo is > lacking the real addresses. > > / # cat /proc/vmallocinfo > 0x(ptrval)-0x(ptrval) 8192 load_module+0xc0c/0x2c0c pages=1 vmalloc > 0x(ptrval)-0x(ptrval) 12288 start_kernel+0x4e0/0x690 pages=2 vmalloc > 0x(ptrval)-0x(ptrval) 12288 start_kernel+0x4e0/0x690 pages=2 vmalloc > 0x(ptrval)-0x(ptrval) 8192 _mpic_map_mmio.constprop.0+0x20/0x44 phys=0x80041000 ioremap > 0x(ptrval)-0x(ptrval) 12288 _mpic_map_mmio.constprop.0+0x20/0x44 phys=0x80041000 ioremap > ... > > According to the documentation for /proc/sys/kernel/, %pK is > equivalent to %p when kptr_restrict is set to 0. Good catch! BTW: The behavior is strange also when kptr_restrict == 1. It allways prints non-hashed pointers for user space adresses. It means that it is less restrictive than kptr_restrict == 0 by default when no_hash_pointers == 0. It is probably not a big deal but... > --- > lib/vsprintf.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > > diff --git a/lib/vsprintf.c b/lib/vsprintf.c > index 3b8129dd374c..9c60d6e1a0d6 100644 > --- a/lib/vsprintf.c > +++ b/lib/vsprintf.c > @@ -857,6 +861,8 @@ char *restricted_pointer(char *buf, char *end, const void *ptr, > switch (kptr_restrict) { > case 0: > /* Handle as %p, hash and do _not_ leak addresses. */ > + if (unlikely(no_hash_pointers)) > + break; > return ptr_to_id(buf, end, ptr, spec); This is a twisted duplication of the following code from pointer(): static noinline_for_stack char *pointer(const char *fmt, char *buf, char *end, void *ptr, struct printf_spec spec) { [...] /* * default is to _not_ leak addresses, so hash before printing, * unless no_hash_pointers is specified on the command line. */ if (unlikely(no_hash_pointers)) return pointer_string(buf, end, ptr, spec); else return ptr_to_id(buf, end, ptr, spec); } Instead, I would create: /* * default is to _not_ leak addresses, so hash before printing, * unless no_hash_pointers is specified on the command line. */ static noinline_for_stack char *default_pointer(const char *fmt, char *buf, char *end, void *ptr, struct printf_spec spec) { if (unlikely(no_hash_pointers)) return pointer_string(buf, end, ptr, spec); return ptr_to_id(buf, end, ptr, spec); } and use it in both hash_pointer() and pointer(). And I would use is also for kptr_restrict == 1. But it probably should be done in a separate patch and should be acked by Kees. > case 1: { > const struct cred *cred; Best Regards, Petr
On Tue, Feb 08, 2022 at 02:51:39PM +0100, Petr Mladek wrote: > On Thu 2022-01-27 11:11:02, Christophe Leroy wrote: ... > Instead, I would create: > > /* > * default is to _not_ leak addresses, so hash before printing, > * unless no_hash_pointers is specified on the command line. > */ > static noinline_for_stack > char *default_pointer(const char *fmt, char *buf, char *end, void *ptr, > struct printf_spec spec) > { > if (unlikely(no_hash_pointers)) > return pointer_string(buf, end, ptr, spec); > > return ptr_to_id(buf, end, ptr, spec); > } > > and use it in both hash_pointer() and pointer(). I like this idea.
diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 3b8129dd374c..9c60d6e1a0d6 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -848,6 +848,10 @@ static char *ptr_to_id(char *buf, char *end, const void *ptr, return pointer_string(buf, end, (const void *)hashval, spec); } +/* Disable pointer hashing if requested */ +bool no_hash_pointers __ro_after_init; +EXPORT_SYMBOL_GPL(no_hash_pointers); + int kptr_restrict __read_mostly; static noinline_for_stack @@ -857,6 +861,8 @@ char *restricted_pointer(char *buf, char *end, const void *ptr, switch (kptr_restrict) { case 0: /* Handle as %p, hash and do _not_ leak addresses. */ + if (unlikely(no_hash_pointers)) + break; return ptr_to_id(buf, end, ptr, spec); case 1: { const struct cred *cred; @@ -2223,10 +2229,6 @@ char *fwnode_string(char *buf, char *end, struct fwnode_handle *fwnode, return widen_string(buf, buf - buf_start, end, spec); } -/* Disable pointer hashing if requested */ -bool no_hash_pointers __ro_after_init; -EXPORT_SYMBOL_GPL(no_hash_pointers); - int __init no_hash_pointers_enable(char *str) { if (no_hash_pointers)
Although kptr_restrict is set to 0 and the kernel is booted with no_hash_pointers parameter, the content of /proc/vmallocinfo is lacking the real addresses. / # cat /proc/vmallocinfo 0x(ptrval)-0x(ptrval) 8192 load_module+0xc0c/0x2c0c pages=1 vmalloc 0x(ptrval)-0x(ptrval) 12288 start_kernel+0x4e0/0x690 pages=2 vmalloc 0x(ptrval)-0x(ptrval) 12288 start_kernel+0x4e0/0x690 pages=2 vmalloc 0x(ptrval)-0x(ptrval) 8192 _mpic_map_mmio.constprop.0+0x20/0x44 phys=0x80041000 ioremap 0x(ptrval)-0x(ptrval) 12288 _mpic_map_mmio.constprop.0+0x20/0x44 phys=0x80041000 ioremap ... According to the documentation for /proc/sys/kernel/, %pK is equivalent to %p when kptr_restrict is set to 0. Fixes: 1ac2f9789c4b ("vsprintf: Consistent %pK handling for kptr_restrict == 0") Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu> --- lib/vsprintf.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)