Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Jane Chu <jane.chu@oracle.com>
To:     pmladek@suse.com, rostedt@goodmis.org, senozhatsky@chromium.org,
        andriy.shevchenko@linux.intel.com, linux@rasmusvillemoes.dk,
        linux-kernel@vger.kernel.org
Cc:     jane.chu@oracle.com
Subject: [PATCH v2] vsprintf: protect kernel from panic due to non-canonical pointer dereference
Date:   Mon, 17 Oct 2022 13:44:47 -0600
Message-Id: <20221017194447.2579441-1-jane.chu@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?xBELa0ei9x3pF3Z3K6F5/0kzzB+3GTp2U0TduH8J+2cl82pY/LzSxE9djvg7?=
 =?us-ascii?Q?gUo0+TuJqNb9Rqigtq1MVtCiC9P8UnWNk1jneY8u2ttudK2CnMk0132vjfOH?=
 =?us-ascii?Q?mTl6mJYnIGXIGurAJ6gsqItzzDc/9Vxlj9DdOUQttUvVaC8gs6wNqIglmBwI?=
 =?us-ascii?Q?FJqXxC1UxPBWjAIK6dvCQUyPBpozq7LCBu51WadZmJEe7ZLm4FWnPf5o5+No?=
 =?us-ascii?Q?LpZl/psJ3D0FVZy7A1DSNwJSQ2gsAY0p+g66AfP5pfYTc8EvWQIJN5pFbQh/?=
 =?us-ascii?Q?3/yva8tFNCqGe4mpgsFtvpirQ50+lXUjd+qjCajLzfaQ2JL6yMNUATHUcFof?=
 =?us-ascii?Q?d3xUj8Rfz0MkLJlZoMjI8wQ8SQtTbn8LbF/dM93qTvUiPgny1Dr+HY0jzd0Z?=
 =?us-ascii?Q?VuTtcpugjxW0AgEHpRbiq3l6R43Jdd74M5mfy9nHLA3EyPRVGEYYLhQR1KOc?=
 =?us-ascii?Q?Y+39sMocIhTj1S1CvaZOJCaQSCTmmUIE4r0WuJM23SbMAAAZi7KTSJWO2x+t?=
 =?us-ascii?Q?fuF1GvXDSXfyB49y88f815SO+nBhDkMFZSB6hKbXHQ7mvkGe5+1vS3oDzzs6?=
 =?us-ascii?Q?2MuiycfE2FgciB7/nU1duq2PZob9fXgP+J+vKSbexpXb4LjUcYKOg0zfrnrV?=
 =?us-ascii?Q?BtVhjgKhf0KY25FaG/PLhNNDBKf9WyrjfW5YltlkDrf5Go0vIBQJmtqbwE81?=
 =?us-ascii?Q?4Kfv7pIX1Sx2HGlxtuVU9E+MFTticQ9P305tBAXewpflZrAWrdndrIBmG4mI?=
 =?us-ascii?Q?psDIG7Am9UlladWO1M3KBZtwTA6Gt9UqHTK40S38yuN74xHkQ1OQB223JsAz?=
 =?us-ascii?Q?GavNbmErO8aGi9DJrYAzh1jBjHFuJdpHABBYEQpPaas7PbpUDun3sO/3ny4j?=
 =?us-ascii?Q?/k9hj5zZvD+DszKmGBWxUnb0Pdf/VnUvPozTAoKcIKWYTWnWXAjPtgsUAD7l?=
 =?us-ascii?Q?kq5aFiv4JubFqVNxHDvc1id9zDfwtX0oeZ7l+n7WcjqIFWHYzKyTCm8TzTxg?=
 =?us-ascii?Q?oLlQce3Gepaa7vkezqFto0PYOvP4QSGqkMp+E4VoyQ8mABJTV6340Ne+VxQQ?=
 =?us-ascii?Q?liVP1KJ1/QVWDEK2rmmv+vKGM2sjE1voVtG+YENCA6qRiAnq1224Gzu5atRM?=
 =?us-ascii?Q?L45fspC7QZLtzPzZ6kq+sRS2RHCWTzJZGKS8RuQvlNq+Tm0TMhGMcrq3Brts?=
 =?us-ascii?Q?TsMr7vmYVWoxTD4QbLqterb8mYrsZvxcUmh52gk2j0dlKt6C62vHmoEeBB+Y?=
 =?us-ascii?Q?+Derj0RmPmUduVD5OXM9hqCYh2u8nb+YXwQ34Tb7XpAH5UWGCv6NEk0ZDoZY?=
 =?us-ascii?Q?UwAsLW9qtuLnCuLASoBY63QuaIC/c+xkMMkmeIoRAb6BUb8Q2v92+psbuFUL?=
 =?us-ascii?Q?1E1iqQrxGWCD6mjUWgRA5OnXlcAdadaX4dLfYJc545xnDhRNHGoU2JykxfRR?=
 =?us-ascii?Q?l3tnCePNf49qB6fSDQOr7jS17XihImEl0gmD4a3t3pH1DNpjeiE5aBqjeuFg?=
 =?us-ascii?Q?pqFe9A5cyu6a926je1mHq8YGEBe4YTXz/5ZeTzzebnrsvEVmGyOuk1EjEwis?=
 =?us-ascii?Q?vV90WukSECf6yl8FIFa3D6G0yx2349X1LsXj3QBHNQwr/cupJjo7vbAYBZIs?=
 =?us-ascii?Q?ew=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: cb64f30e-14de-408b-53b7-08dab078133c
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4429.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Oct 2022 19:44:59.3329
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: kyWJBuniu+GNrCK27SlpJe+UjHoPA9PIVj2xUZF1zxhqhqV+chyOLiexpYODtONFkoWJ2E1fhYECvgV9iMNKvQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB4215
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-10-17_13,2022-10-17_02,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 bulkscore=0 mlxscore=0
 suspectscore=0 mlxlogscore=999 phishscore=0 malwarescore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000
 definitions=main-2210170113
X-Proofpoint-GUID: D6Hl7ionjuajXnW6wsRnf-pXPwmZ2LXk
X-Proofpoint-ORIG-GUID: D6Hl7ionjuajXnW6wsRnf-pXPwmZ2LXk
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

While debugging a separate issue, it was found that an invalid string
pointer could very well contain a non-canical address, such as
0x7665645f63616465. In that case, this line of defense isn't enough
to protect the kernel from crashing due to general protection fault

	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
                return "(efault)";

So run one more round of check via kern_addr_valid(). On architectures
that provide meaningful implementation, this line of check effectively
catches non-canonical pointers, etc.

Signed-off-by: Jane Chu <jane.chu@oracle.com>
---
 lib/vsprintf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index c414a8d9f1ea..b38c12ef1e45 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -698,6 +698,9 @@ static const char *check_pointer_msg(const void *ptr)
 	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
 		return "(efault)";
 
+	if (!kern_addr_valid((unsigned long)ptr))
+		return "(efault)";
+
 	return NULL;
 }
 
-- 
2.18.4