Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Jane Chu <jane.chu@oracle.com>
To:     pmladek@suse.com, rostedt@goodmis.org, senozhatsky@chromium.org,
        andriy.shevchenko@linux.intel.com, linux@rasmusvillemoes.dk,
        linux-kernel@vger.kernel.org
Cc:     jane.chu@oracle.com
Subject: [PATCH] vsprintf: protect kernel from panic due to non-canonical pointer dereference
Date:   Mon, 17 Oct 2022 13:16:11 -0600
Message-Id: <20221017191611.2577466-1-jane.chu@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?mvaCSVNL+KA6/zzzrU7T04+FLGO0vJPpTgehYJuKnb2tHxxyqUjcr4XShIKw?=
 =?us-ascii?Q?RB/KwjiMG5zy3Vu4qQaWDs0JxYRq6hZxjbYpNwpXan/2TCcAKWSenKvn5t13?=
 =?us-ascii?Q?Aeov8YdJmPGi1dMYjrOCt5JIY/JJ373JNo/PYMH9ca+kfQ5SyEZ9ej/pt0+X?=
 =?us-ascii?Q?h339OqPlJMH3my6XtXxm5wHTjWpdbtJH8LqH+5dytfK/xhkF2GbSp1R+q6C1?=
 =?us-ascii?Q?M3YybfBK5IvEUpjCVQJBJDVMdFrUvHdj+ayMpi6Y3eEsvdilPyxhKNP+25MK?=
 =?us-ascii?Q?Koe210QzL60s6BNjfl87HkK6JmH4MZww4sUNe+Kp+V3KEh4Wp4gLJgtoV6gk?=
 =?us-ascii?Q?UR+Tq0E9r6p8c7WIVsRXQWZzOuVQJLIVxR4mPPIv3W3c3u4oQ6XY/a14zhEv?=
 =?us-ascii?Q?5hl8M3wogA5ihuvYhBviId0deDWnUu4+dHqncXjfa0o2NQeoQtmk7wWv65HO?=
 =?us-ascii?Q?kiIKNfb5UDxQIFvRXwhN+XFYmoxDT3m+59bo5qOFWH2z2LzrrwKhoK8UlKlw?=
 =?us-ascii?Q?TZ5j4OJw+5NjkwmId41EgBDL8F8EqGzvplsZhodT8Y57JHIKIyoMfkjrFcWb?=
 =?us-ascii?Q?JGsHaGC9QgB8VeF5y0a7C/nq5JnuHjf/wXd+y6aT/QYLYPt1kVoGpcziHGbr?=
 =?us-ascii?Q?NpKEEDS/I5Y9nzzA30ggwqb3RYBYlkiRdh1MfPAc5WP4AWyf4YGo+8DHsw0x?=
 =?us-ascii?Q?QHRxdaYIW/vgnsvYeU4gaT7R0z2r9ERvI3QE7dKDSg1//dPz3tZLtxsNJxtX?=
 =?us-ascii?Q?FVLm7prapjsgrx3TKBHdky4nIWloGqx+cujUpalfWks+HhXl6mDBpDy62uaI?=
 =?us-ascii?Q?OHwE6ZfiOXpQC0gumEkjRUWK8YoL/u1C6JQXKECbvN9mtedcaW93yiG8u3Af?=
 =?us-ascii?Q?7dWF1ul0sXge8+kPh/AUv34iNZMyDn9ezTbFOZMLXU9J2U6/G90ntgiRay63?=
 =?us-ascii?Q?hg0cD5FdxuXpjWTqLL15Lt6QMpYCVBnaoJKZzjbHr7K38uh58u1JjxHKwvCf?=
 =?us-ascii?Q?3rX64eyPuJDZhPbPf7Iu2ArAjGzOPF5BjS4ds2jDjEPz8BM3bU3uIaEVpOfY?=
 =?us-ascii?Q?mP0oK9bBZE8//ypFhU6oTeECqsI58Ghzfncu1rI9C7PQEhwcoWqRwwV0u/wE?=
 =?us-ascii?Q?3horGZ9nIl98H1uo+NAxef6yCmTn1u6B3R82T0WpA7WS73/jiSSu6w+/Se9f?=
 =?us-ascii?Q?4f0fCO1YEidjOj9QZDIY0bwAEzVToxVdDdXGtx9zlZ+jCsl0guYjIthJALp8?=
 =?us-ascii?Q?dBSTztx2MaraWHFeIKZiPH8sIFUsPveETjbOkVhl6OtAR3TYuMazy5GTWjQF?=
 =?us-ascii?Q?k4xvBIB6LI0LilOcPhZFXJ4qj6mqePUG4Bsb5ygDF6oKL/fnyCAiGgXAl8Vk?=
 =?us-ascii?Q?9Vx4C6XU3HKQEbInaaLvGtn0HEf4xCji2KZn9CNiEPuWuigaD15/HhVvzqLP?=
 =?us-ascii?Q?EUWGseAgFTmGvFewJ4qRn6aLU7B9D0figGBAFGRFaf7flEt+xmONv5qGonRz?=
 =?us-ascii?Q?tHBnenShv2RiUuAbAfIX+oInDJRNwSLs8EBgutsXHYnLkR7+vzxTfS6LNpmO?=
 =?us-ascii?Q?uNfZbShMVzQDVQYrJgv3UTobePACeEZR7kfxtaNFvOyHQKhGjh+fF2Gr1xyn?=
 =?us-ascii?Q?ng=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: efb280a3-ffc4-46df-1c2e-08dab0741d3c
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4429.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Oct 2022 19:16:38.0926
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: OEuI13nD1IibcEA2oVRn8U8mBT2IlaN0qwTsbHbmca7LTJhOOwXLOOwpdrtX2Xq1XVN2ip4Xm/jYM2nIoVhJew==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB4937
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-10-17_13,2022-10-17_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 bulkscore=0 mlxscore=0
 suspectscore=0 mlxlogscore=999 phishscore=0 malwarescore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000
 definitions=main-2210170111
X-Proofpoint-ORIG-GUID: gDxEXUwJUlumqUIAzW9-No7ubg4I8x6V
X-Proofpoint-GUID: gDxEXUwJUlumqUIAzW9-No7ubg4I8x6V
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

While debugging a separate issue, it was found that an invalid string
pointer could very well contain a non-canical address, such as
0x7665645f63616465. In that case, this line of defense isn't enough
to protect the kernel from crashing due to general protection fault

	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
                return "(efault)";

So instead, use kern_addr_valid() to validate the string pointer.

Signed-off-by: Jane Chu <jane.chu@oracle.com>
---
 lib/vsprintf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index c414a8d9f1ea..2e8a9efc7c12 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -695,7 +695,7 @@ static const char *check_pointer_msg(const void *ptr)
 	if (!ptr)
 		return "(null)";
 
-	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
+	if (!kern_addr_valid((unsigned long)ptr))
 		return "(efault)";
 
 	return NULL;
-- 
2.18.4