Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Jane Chu <jane.chu@oracle.com>
To:     pmladek@suse.com, rostedt@goodmis.org, senozhatsky@chromium.org,
        andriy.shevchenko@linux.intel.com, linux@rasmusvillemoes.dk,
        linux-mm@kvack.org, linux-kernel@vger.kernel.org
Cc:     wangkefeng.wang@huawei.com, konrad.wilk@oracle.com,
        haakon.bugge@oracle.com, john.haxby@oracle.com, jane.chu@oracle.com
Subject: [PATCH v3 1/1] vsprintf: protect kernel from panic due to non-canonical pointer dereference
Date:   Wed, 19 Oct 2022 13:34:31 -0600
Message-Id: <20221019193431.2923462-2-jane.chu@oracle.com>
In-Reply-To: <20221019193431.2923462-1-jane.chu@oracle.com>
References: <20221019193431.2923462-1-jane.chu@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?wbjUvIWOsyJ81KPwUKnKtGeaON7G2STTMlkc/AfXVO66iwN4ogisyakK72f+?=
 =?us-ascii?Q?HLyfXy0CGCtWCWW+hbQD+n6K7VCy+w99nOLn0DqZ/lAhkHBr1wTsxwKxA0ey?=
 =?us-ascii?Q?S+mBKehmhyArm0ti4XY6d+wtfCL1rVWSi6IHHYv1f7zNQ94K+8vxB5jIGgfS?=
 =?us-ascii?Q?2x+VhCIaOqjboC+VTsBaGsiHcnqaTcDVmTxvv067zaSU3zjD4op9pkffVPh6?=
 =?us-ascii?Q?5kqa0Uz/Fp9YNALdqVKmmJs4/v5A2UutevWS6onToUcOKaUZYXp8i4ytxlTH?=
 =?us-ascii?Q?2D+0D2E1j4edvtF8TY5x29TLUQgGEGdRYaGFYBpiaL1CE2+UQF/vuOYT1T5Y?=
 =?us-ascii?Q?RxezdWrLJFfvnAlGMTlMke7R0MJpOJRj+Q+vcAo5RLl1ocEOpD2u5ESDLhIt?=
 =?us-ascii?Q?kWZZNG9nlpDC6nKrGtfp2eVPCl/g2ipJvUE0X/X9CBRlQukSORw2zw325bkU?=
 =?us-ascii?Q?wTGJ8HnCu49gkHzQsk7IjleHfEgE6AQeSkXiZFob5k6DOuA0N487TNlPa0AS?=
 =?us-ascii?Q?jyzesiWzIUMHQFv8ffCHju5e1UyA+5rinLfZjRLtMHf4Kx2vFYUcNT4fTjNQ?=
 =?us-ascii?Q?WyVNsGRBtEi9yzm957Xe+ZEjxCZxglD5LeEJmaWPyZqgb9T0qv38cx+6gzFT?=
 =?us-ascii?Q?HK2KleSSm8UlJuxvFMwOqB7UVLvhSCa3Ac5i+6KzNNaFNNR174/guWgpXxid?=
 =?us-ascii?Q?Rxm2b0oE975wZVUfieMMzofhZkD0gFOIEwvuEzdqLwUdhyyGXdKK/Mf9Q4JG?=
 =?us-ascii?Q?JtilmQ9o+YlbHX5HzqYn2VfIt/XFairsFcIJPj3eMKsPlLxeV+M6zcdAfIfT?=
 =?us-ascii?Q?6rOJ2dpRyUA8Vf7khn6Es5KroIJkDPBZYonPtPgsX83NrZrUJGqne68x8NoA?=
 =?us-ascii?Q?DRTCqFXhJnrSwl+EFFgN/Mpn9tsLEsM6Su+EmjwpV4IPRaG7HDToVmkjGDtH?=
 =?us-ascii?Q?G8zXg5rwGToYorJpMh1zbRISh3dyJmWHbADAhJNyUYoYEv67v0JSNUiFcVjF?=
 =?us-ascii?Q?TL3HG/so59RjMDxEnRIrDsgWvC5e38XeSqBPufNO33pqBAPTMgHw72JYi3lv?=
 =?us-ascii?Q?Mcrl42vZh5FTzmRw9Q66mn/zJxWDq1cJxDX+Sbu1Jov34utu8cHj3y43sa5z?=
 =?us-ascii?Q?4jL0rOyZ929HQEzI68mZbV4vOUgaAgCtPkJpPitRcvmBYcmfTH0XyHCLGL9r?=
 =?us-ascii?Q?BetQmWp4KYPWB7duXIF2dG7uLX5KN2M3d+kSL/4xb9kdT7a0vAV4oIWGaEFQ?=
 =?us-ascii?Q?ScgjEBeWNT3ROvlWhqaRN08bNgkT99Hv552mXj2ONnXHxx++zKOCG2jyPBon?=
 =?us-ascii?Q?8lBGTy0df/t8rUzPT4tU1Kz5YOAvUDY3GeOEfklhkUtq1kpEGuyQVXjDXS+b?=
 =?us-ascii?Q?VwRH6ie9bHsn+X0Rex7CG2GAyWfuz4r/P0uKodgOvi0Fy+TvvePpFcoVkPX2?=
 =?us-ascii?Q?tYg580oqZTfn8vq2mZnst9PdHr0OKKmfVU7ZxlkBOulJRWfbZCkds5K23msX?=
 =?us-ascii?Q?pAiY/+OUeIMj+l9/RGwD5yA5nfQMo4tKEn3MYq0iCkKdAoKWISjkAW2p7brw?=
 =?us-ascii?Q?rSthlGyJQVozDgpY6DHXuC2Nti6fQMhmSVJSkMAVF5g2odoSjQzxVw+xpZv1?=
 =?us-ascii?Q?1Q=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4d862e8a-9400-4fa3-f523-08dab20905d0
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4429.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2022 19:35:04.9938
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: lmP1rk73RnhmYUMcDAtNUtiZEej3tJZm9coSI4vAjAujOyyMbRbeZmDR4law/BLEtSCcxQ8WkEl6NUsACH3Yug==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5274
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-10-19_11,2022-10-19_04,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 spamscore=0 bulkscore=0
 mlxscore=0 phishscore=0 suspectscore=0 adultscore=0 mlxlogscore=999
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000
 definitions=main-2210190110
X-Proofpoint-ORIG-GUID: thcmcBxTODlROz6ojSHTKTZ-3d1MEGZ0
X-Proofpoint-GUID: thcmcBxTODlROz6ojSHTKTZ-3d1MEGZ0
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Having stepped on a local kernel bug where reading sysfs has led to
out-of-bound pointer dereference by vsprintf() which led to GPF panic.
And the reason for GPF is that the OOB pointer was turned to a
non-canonical address such as 0x7665645f63616465.

vsprintf() already has this line of defense
	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
                return "(efault)";
Since a non-canonical pointer can be detected by kern_addr_valid()
on architectures that present VM holes as well as meaningful
implementation of kern_addr_valid() that detects the non-canonical
addresses, this patch addes a check on non-canonical string pointer by
kern_addr_valid() and display "(efault)" to alert user that something
is wrong instead of unecessarily panic the server.

On the other hand, if the non-canonical string pointer is dereferenced
else where in the kernel, by virtue of being non-canonical, a crash
is expected to be immediate.

Signed-off-by: Jane Chu <jane.chu@oracle.com>
---
 lib/vsprintf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index c414a8d9f1ea..b38c12ef1e45 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -698,6 +698,9 @@ static const char *check_pointer_msg(const void *ptr)
 	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
 		return "(efault)";
 
+	if (!kern_addr_valid((unsigned long)ptr))
+		return "(efault)";
+
 	return NULL;
 }
 
-- 
2.18.4