2020-02-29 23:12:44

by Arvind Sankar

Subject: [PATCH] x86/mm/init: Stop printing pgt_buf addresses

This currently leaks kernel physical addresses into userspace.

Signed-off-by: Arvind Sankar <[email protected]>
---
arch/x86/mm/init.c | 2 --
1 file changed, 2 deletions(-)

diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index e7bb483557c9..dc4711f09cdc 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -121,8 +121,6 @@ __ref void *alloc_low_pages(unsigned int num)
} else {
pfn = pgt_buf_end;
pgt_buf_end += num;
- printk(KERN_DEBUG "BRK [%#010lx, %#010lx] PGTABLE\n",
- pfn << PAGE_SHIFT, (pgt_buf_end << PAGE_SHIFT) - 1);
}

for (i = 0; i < num; i++) {
--
2.24.1

2020-02-29 23:34:01

by Kees Cook

Subject: Re: [PATCH] x86/mm/init: Stop printing pgt_buf addresses

On Sat, Feb 29, 2020 at 06:11:20PM -0500, Arvind Sankar wrote:
> This currently leaks kernel physical addresses into userspace.
>
> Signed-off-by: Arvind Sankar <[email protected]>

Acked-by: Kees Cook <[email protected]>

-Kees

> ---
> arch/x86/mm/init.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
> index e7bb483557c9..dc4711f09cdc 100644
> --- a/arch/x86/mm/init.c
> +++ b/arch/x86/mm/init.c
> @@ -121,8 +121,6 @@ __ref void *alloc_low_pages(unsigned int num)
> } else {
> pfn = pgt_buf_end;
> pgt_buf_end += num;
> - printk(KERN_DEBUG "BRK [%#010lx, %#010lx] PGTABLE\n",
> - pfn << PAGE_SHIFT, (pgt_buf_end << PAGE_SHIFT) - 1);
> }
>
> for (i = 0; i < num; i++) {
> --
> 2.24.1
>

--
Kees Cook

2020-04-09 22:22:52

by Arvind Sankar

Subject: Re: [PATCH] x86/mm/init: Stop printing pgt_buf addresses

On Sat, Feb 29, 2020 at 06:11:20PM -0500, Arvind Sankar wrote:
> This currently leaks kernel physical addresses into userspace.
>
> Signed-off-by: Arvind Sankar <[email protected]>
> ---
> arch/x86/mm/init.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
> index e7bb483557c9..dc4711f09cdc 100644
> --- a/arch/x86/mm/init.c
> +++ b/arch/x86/mm/init.c
> @@ -121,8 +121,6 @@ __ref void *alloc_low_pages(unsigned int num)
> } else {
> pfn = pgt_buf_end;
> pgt_buf_end += num;
> - printk(KERN_DEBUG "BRK [%#010lx, %#010lx] PGTABLE\n",
> - pfn << PAGE_SHIFT, (pgt_buf_end << PAGE_SHIFT) - 1);
> }
>
> for (i = 0; i < num; i++) {
> --
> 2.24.1
>

This was acked by Kees, is it ok for merge?

Thanks.

2020-04-09 22:38:19

by Dave Hansen

Subject: Re: [PATCH] x86/mm/init: Stop printing pgt_buf addresses

On 4/9/20 3:19 PM, Arvind Sankar wrote:
>> @@ -121,8 +121,6 @@ __ref void *alloc_low_pages(unsigned int num)
>> } else {
>> pfn = pgt_buf_end;
>> pgt_buf_end += num;
>> - printk(KERN_DEBUG "BRK [%#010lx, %#010lx] PGTABLE\n",
>> - pfn << PAGE_SHIFT, (pgt_buf_end << PAGE_SHIFT) - 1);
>> }
>>
>> for (i = 0; i < num; i++) {
>> --
>> 2.24.1
>>
> This was acked by Kees, is it ok for merge?

Independent of the obvious security implications, I don't think I've
ever once gleaned useful information from that message. It's fine by me.

Acked-by: Dave Hansen <[email protected]>

2020-05-23 01:55:51

by Arvind Sankar

Subject: Re: [PATCH] x86/mm/init: Stop printing pgt_buf addresses

On Sat, Feb 29, 2020 at 06:11:20PM -0500, Arvind Sankar wrote:
> This currently leaks kernel physical addresses into userspace.
>
> Signed-off-by: Arvind Sankar <[email protected]>
> ---
> arch/x86/mm/init.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
> index e7bb483557c9..dc4711f09cdc 100644
> --- a/arch/x86/mm/init.c
> +++ b/arch/x86/mm/init.c
> @@ -121,8 +121,6 @@ __ref void *alloc_low_pages(unsigned int num)
> } else {
> pfn = pgt_buf_end;
> pgt_buf_end += num;
> - printk(KERN_DEBUG "BRK [%#010lx, %#010lx] PGTABLE\n",
> - pfn << PAGE_SHIFT, (pgt_buf_end << PAGE_SHIFT) - 1);
> }
>
> for (i = 0; i < num; i++) {
> --
> 2.24.1
>

Ping.

https://lore.kernel.org/lkml/[email protected]/

2020-05-23 03:02:30

by Joe Perches

Subject: Re: [PATCH] x86/mm/init: Stop printing pgt_buf addresses

On Fri, 2020-05-22 at 21:51 -0400, Arvind Sankar wrote:
> On Sat, Feb 29, 2020 at 06:11:20PM -0500, Arvind Sankar wrote:
> > This currently leaks kernel physical addresses into userspace.
> >
> > Signed-off-by: Arvind Sankar <[email protected]>
> > ---
> > arch/x86/mm/init.c | 2 --
> > 1 file changed, 2 deletions(-)
> >
> > diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
> > index e7bb483557c9..dc4711f09cdc 100644
> > --- a/arch/x86/mm/init.c
> > +++ b/arch/x86/mm/init.c
> > @@ -121,8 +121,6 @@ __ref void *alloc_low_pages(unsigned int num)
> > } else {
> > pfn = pgt_buf_end;
> > pgt_buf_end += num;
> > - printk(KERN_DEBUG "BRK [%#010lx, %#010lx] PGTABLE\n",
> > - pfn << PAGE_SHIFT, (pgt_buf_end << PAGE_SHIFT) - 1);
> > }
> >
> > for (i = 0; i < num; i++) {
> > --
> > 2.24.1
> >
>
> Ping.
>
> https://lore.kernel.org/lkml/[email protected]/

If this output is at all valuable,
perhaps emit them as hashed pointers?

Maybe:

---
arch/x86/mm/init.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 1bba16c5742b..44f0d6592c7e 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -121,8 +121,9 @@ __ref void *alloc_low_pages(unsigned int num)
} else {
pfn = pgt_buf_end;
pgt_buf_end += num;
- printk(KERN_DEBUG "BRK [%#010lx, %#010lx] PGTABLE\n",
- pfn << PAGE_SHIFT, (pgt_buf_end << PAGE_SHIFT) - 1);
+ printk(KERN_DEBUG "BRK [0x%8p, 0x%8p] PGTABLE\n",
+ (void *)(pfn << PAGE_SHIFT),
+ (void *)((pgt_buf_end << PAGE_SHIFT) - 1));
}

for (i = 0; i < num; i++) {

2020-05-23 07:45:48

by tip-bot2 for Alexey Makhalov

Subject: [tip: x86/cleanups] x86/mm: Stop printing BRK addresses

The following commit has been merged into the x86/cleanups branch of tip:

Commit-ID: 67d631b7c05eff955ccff4139327f0f92a5117e5
Gitweb: https://git.kernel.org/tip/67d631b7c05eff955ccff4139327f0f92a5117e5
Author: Arvind Sankar <[email protected]>
AuthorDate: Sat, 29 Feb 2020 18:11:20 -05:00
Committer: Borislav Petkov <[email protected]>
CommitterDate: Sat, 23 May 2020 09:34:18 +02:00

x86/mm: Stop printing BRK addresses

This currently leaks kernel physical addresses into userspace.

Signed-off-by: Arvind Sankar <[email protected]>
Signed-off-by: Borislav Petkov <[email protected]>
Acked-by: Kees Cook <[email protected]>
Acked-by: Dave Hansen <[email protected]>
Link: https://lkml.kernel.org/r/[email protected]
---
arch/x86/mm/init.c | 2 --
1 file changed, 2 deletions(-)

diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 1bba16c..a573a3e 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -121,8 +121,6 @@ __ref void *alloc_low_pages(unsigned int num)
} else {
pfn = pgt_buf_end;
pgt_buf_end += num;
- printk(KERN_DEBUG "BRK [%#010lx, %#010lx] PGTABLE\n",
- pfn << PAGE_SHIFT, (pgt_buf_end << PAGE_SHIFT) - 1);
}

for (i = 0; i < num; i++) {