From patchwork Tue Feb 9 15:13:29 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marco Elver X-Patchwork-Id: 12078383 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DE11AC433DB for ; Tue, 9 Feb 2021 15:13:49 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 5ABD064E88 for ; Tue, 9 Feb 2021 15:13:49 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 5ABD064E88 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id AD8D26B0005; Tue, 9 Feb 2021 10:13:48 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id A89A06B006C; Tue, 9 Feb 2021 10:13:48 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 979146B006E; Tue, 9 Feb 2021 10:13:48 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0225.hostedemail.com [216.40.44.225]) by kanga.kvack.org (Postfix) with ESMTP id 80C6E6B0005 for ; Tue, 9 Feb 2021 10:13:48 -0500 (EST) Received: from smtpin09.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 45635181A88ED for ; Tue, 9 Feb 2021 15:13:48 +0000 (UTC) X-FDA: 77799074136.09.gold47_5703b9f27608 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin09.hostedemail.com (Postfix) with ESMTP id 21C10180ACC54 for ; Tue, 9 Feb 2021 15:13:48 +0000 (UTC) X-HE-Tag: gold47_5703b9f27608 X-Filterd-Recvd-Size: 7411 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) by imf36.hostedemail.com (Postfix) with ESMTP for ; Tue, 9 Feb 2021 15:13:47 +0000 (UTC) Received: by mail-wm1-f73.google.com with SMTP id n17so2845963wmk.3 for ; Tue, 09 Feb 2021 07:13:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:message-id:mime-version:subject:from:to:cc; bh=SX0HiwfnPZUJT/hHYA0MIVTfSj70h4+JBgQfnaAr/u4=; b=pHK0u1wb/U/XIFExQx2+la0yPbi2HiObpWHcMDueY02GzwNDf6wDzk2gCsMOWgVriQ wwc6YOORAQFxUUr6RHSe9pm1gp7SIYf1QLXwPt1IZao9+mZXiFxM2her7vWOb/ECj9II ZOsTA7Me6ZfdZBhSYtyZnjxcz4ciiURntrzujonwBSCk0DMbbI1LFANy99uwWUO+fhzS tMlW61c0VTYoQwclgY0I01m2nepLPrex5L+uRCxZYXRHlbPy/tN4fqiw41anPj4ND/RQ iJmT4oDzsMsGoLIpq1GphHlnTnmtE4vQ2TPoyJUsNr4wr5Yv1h2sbP+fL9f9iP8k9Z4g mz+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:message-id:mime-version:subject:from :to:cc; bh=SX0HiwfnPZUJT/hHYA0MIVTfSj70h4+JBgQfnaAr/u4=; b=XmQWO1XzbZpg9hluBU0ti7Bwc3Bdb2shO+yePn/3lL2AcuIR0/+SWsE3bTJkpqcWs7 /xxpGcAC/0xskaOnOpQPZQtLahbjzZ8/O9L6hu5xP25iWXw/sFN1L0WdIdOHHjQ1Erfm j35ys/tFzj0rSM9tQV49cA9j22WaI3GTURhO3pngT4osG2snP8C35X4NDtTElosPu+JJ uYfqQ4kwEcvyl2Cl90eAzU7yAXB5fPwCzirRwyNeZtWKTqDD2qqCEgmdmVDMb5f+VFdH +k7bxGAyaOZ2gJZS+UwiC6n5yadN9EKvqfW48rxbDmVAUTD4QfYNUA4D1hz6hriTcm3B QEFg== X-Gm-Message-State: AOAM532dXQY5e+X9xLJZLWQiuKinjqdizbZSoVvLbj1CVNOljgsHVihU 4RXDmbGVA65+kpBXBW/Vpv/0l03Gtg== X-Google-Smtp-Source: ABdhPJy/bfHoIxfvMhq6l/VKJ239p+BDKbsuCzNlG+/0qxtUuQigDelDtEAz0BJI1akEhB9WzcYa1mSk1A== X-Received: from elver.muc.corp.google.com ([2a00:79e0:15:13:51c9:b9a4:3e29:2cd0]) (user=elver job=sendgmr) by 2002:a1c:64c3:: with SMTP id y186mr3902730wmb.58.1612883626184; Tue, 09 Feb 2021 07:13:46 -0800 (PST) Date: Tue, 9 Feb 2021 16:13:29 +0100 Message-Id: <20210209151329.3459690-1-elver@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.30.0.478.g8a0d178c01-goog Subject: [PATCH mm] kfence: make reporting sensitive information configurable From: Marco Elver To: elver@google.com, akpm@linux-foundation.org Cc: glider@google.com, dvyukov@google.com, andreyknvl@google.com, jannh@google.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, kasan-dev@googlegroups.com X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: We cannot rely on CONFIG_DEBUG_KERNEL to decide if we're running a "debug kernel" where we can safely show potentially sensitive information in the kernel log. Therefore, add the option CONFIG_KFENCE_REPORT_SENSITIVE to decide if we should add potentially sensitive information to KFENCE reports. The default behaviour remains unchanged. Signed-off-by: Marco Elver --- Documentation/dev-tools/kfence.rst | 6 +++--- lib/Kconfig.kfence | 8 ++++++++ mm/kfence/core.c | 2 +- mm/kfence/kfence.h | 3 +-- mm/kfence/report.c | 6 +++--- 5 files changed, 16 insertions(+), 9 deletions(-) diff --git a/Documentation/dev-tools/kfence.rst b/Documentation/dev-tools/kfence.rst index 58a0a5fa1ddc..5280d644f826 100644 --- a/Documentation/dev-tools/kfence.rst +++ b/Documentation/dev-tools/kfence.rst @@ -89,7 +89,7 @@ A typical out-of-bounds access looks like this:: The header of the report provides a short summary of the function involved in the access. It is followed by more detailed information about the access and its origin. Note that, real kernel addresses are only shown for -``CONFIG_DEBUG_KERNEL=y`` builds. +``CONFIG_KFENCE_REPORT_SENSITIVE=y`` builds. Use-after-free accesses are reported as:: @@ -184,8 +184,8 @@ invalidly written bytes (offset from the address) are shown; in this representation, '.' denote untouched bytes. In the example above ``0xac`` is the value written to the invalid address at offset 0, and the remaining '.' denote that no following bytes have been touched. Note that, real values are -only shown for ``CONFIG_DEBUG_KERNEL=y`` builds; to avoid information -disclosure for non-debug builds, '!' is used instead to denote invalidly +only shown for ``CONFIG_KFENCE_REPORT_SENSITIVE=y`` builds; to avoid +information disclosure otherwise, '!' is used instead to denote invalidly written bytes. And finally, KFENCE may also report on invalid accesses to any protected page diff --git a/lib/Kconfig.kfence b/lib/Kconfig.kfence index 78f50ccb3b45..141494a5f530 100644 --- a/lib/Kconfig.kfence +++ b/lib/Kconfig.kfence @@ -55,6 +55,14 @@ config KFENCE_NUM_OBJECTS pages are required; with one containing the object and two adjacent ones used as guard pages. +config KFENCE_REPORT_SENSITIVE + bool "Show potentially sensitive information in reports" + default y if DEBUG_KERNEL + help + Show potentially sensitive information such as unhashed pointers, + context bytes on memory corruptions, as well as dump registers in + KFENCE reports. + config KFENCE_STRESS_TEST_FAULTS int "Stress testing of fault handling and error reporting" if EXPERT default 0 diff --git a/mm/kfence/core.c b/mm/kfence/core.c index cfe3d32ac5b7..5f7e02db5f53 100644 --- a/mm/kfence/core.c +++ b/mm/kfence/core.c @@ -648,7 +648,7 @@ void __init kfence_init(void) schedule_delayed_work(&kfence_timer, 0); pr_info("initialized - using %lu bytes for %d objects", KFENCE_POOL_SIZE, CONFIG_KFENCE_NUM_OBJECTS); - if (IS_ENABLED(CONFIG_DEBUG_KERNEL)) + if (IS_ENABLED(CONFIG_KFENCE_REPORT_SENSITIVE)) pr_cont(" at 0x%px-0x%px\n", (void *)__kfence_pool, (void *)(__kfence_pool + KFENCE_POOL_SIZE)); else diff --git a/mm/kfence/kfence.h b/mm/kfence/kfence.h index 1accc840dbbe..48a8196b947b 100644 --- a/mm/kfence/kfence.h +++ b/mm/kfence/kfence.h @@ -16,8 +16,7 @@ #include "../slab.h" /* for struct kmem_cache */ -/* For non-debug builds, avoid leaking kernel pointers into dmesg. */ -#ifdef CONFIG_DEBUG_KERNEL +#ifdef CONFIG_KFENCE_REPORT_SENSITIVE #define PTR_FMT "%px" #else #define PTR_FMT "%p" diff --git a/mm/kfence/report.c b/mm/kfence/report.c index 901bd7ee83d8..5e2dbabbab1d 100644 --- a/mm/kfence/report.c +++ b/mm/kfence/report.c @@ -148,9 +148,9 @@ static void print_diff_canary(unsigned long address, size_t bytes_to_show, for (cur = (const u8 *)address; cur < end; cur++) { if (*cur == KFENCE_CANARY_PATTERN(cur)) pr_cont(" ."); - else if (IS_ENABLED(CONFIG_DEBUG_KERNEL)) + else if (IS_ENABLED(CONFIG_KFENCE_REPORT_SENSITIVE)) pr_cont(" 0x%02x", *cur); - else /* Do not leak kernel memory in non-debug builds. */ + else /* Do not leak kernel memory. */ pr_cont(" !"); } pr_cont(" ]"); @@ -242,7 +242,7 @@ void kfence_report_error(unsigned long address, bool is_write, struct pt_regs *r /* Print report footer. */ pr_err("\n"); - if (IS_ENABLED(CONFIG_DEBUG_KERNEL) && regs) + if (IS_ENABLED(CONFIG_KFENCE_REPORT_SENSITIVE) && regs) show_regs(regs); else dump_stack_print_info(KERN_ERR);