Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Mon, 23 Nov 2020 10:53:24 +0100
From:   Petr Mladek <pmladek@suse.com>
To:     Steven Rostedt <rostedt@goodmis.org>
Cc:     Alan Stern <stern@rowland.harvard.edu>,
        Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
        Kernel development list <linux-kernel@vger.kernel.org>,
        Kees Cook <keescook@chromium.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Linus Torvalds <torvalds@linux-foundation.org>
Subject: Re: Printk specifiers for __user pointers
Message-ID: <X7uGlDg88bI6zebS@alley>
References: <20201120164412.GD619708@rowland.harvard.edu>
 <20201120134242.6cae9e72@gandalf.local.home>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20201120134242.6cae9e72@gandalf.local.home>
Precedence: bulk

On Fri 2020-11-20 13:42:42, Steven Rostedt wrote:
> On Fri, 20 Nov 2020 11:44:12 -0500
> Alan Stern <stern@rowland.harvard.edu> wrote:
> 
> > To the VSPRINTF maintainers:
> > 
> > Documentation/core-api/printk-formats.rst lists a large number of format 
> > specifiers for pointers of various sorts.  Yet as far as I can see, 
> > there is no specifier meant for use with __user pointers.
> > 
> > The security implications of printing the true, unmangled value of a 
> > __user pointer are minimal, since doing so does not leak any kernel 
> > information.  So %px would work, but tools like checkpatch.pl don't like 
> > it.

Just to be sure as I am not a security expert. Is there really that
big difference in the risk? The following scenarios come to my mind:

1. The address would show a well defined location in the userspace
   application? Could it be used to attack the application?

2. The address shows a location that is being accessed by kernel.
   Could not it be used to pass a value that might be used to attack
   kernel?


> > Should a new specifier be added?  If not, should we simply use %px?
> 
> There's currently no user of '%pu' (although there is a '%pus'. Perhaps we
> should have a '%pux'?
> 
> I would even state that if it is used, that if makes sure that the value is
> indeed a user space pointer (goes through the same checks as accessing user
> space), before its printed, otherwise it shows "(fault)" or something.

I have mixed feelings about this.

One one hand, it might make sense to mark locations where userspace
address is printed. We could easily decide how to print them (hash or
value) and we could check that it is really from a userspace one.

But I have few concerns:

1. The existing "%pus" has a kind of opposite meaning. It says what
   address space should be used when the kernel and userspace address
   space is overlapping.

2. There is the history with "%pk". It did not work because people did
   not use it.

3. I am not sure about the output when the address is not from
   userspace. Printing ("fault") is not much helpful. Printing
   hashed value might be confusing. Well, I am still not sure
   that it is really safe to print real userspace addresses
   by default.

Best Regards,
Petr