Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Jane Chu <jane.chu@oracle.com>
To:     pmladek@suse.com, rostedt@goodmis.org, senozhatsky@chromium.org,
        andriy.shevchenko@linux.intel.com, linux@rasmusvillemoes.dk,
        linux-mm@kvack.org, linux-kernel@vger.kernel.org
Cc:     wangkefeng.wang@huawei.com, konrad.wilk@oracle.com,
        haakon.bugge@oracle.com, john.haxby@oracle.com, jane.chu@oracle.com
Subject: [PATCH v3 1/1] vsprintf: protect kernel from panic due to non-canonical pointer dereference
Date:   Wed, 19 Oct 2022 13:41:59 -0600
Message-Id: <20221019194159.2923873-1-jane.chu@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?cLT/ujUNidxBeuWSewIrTDAnDIEL7Cd7R6hs7kFchKamfwVPDuzQLN1mamTc?=
 =?us-ascii?Q?fce0Ln346Ikr2v0+Jv5YdDFo5+rUuL9JRZe1lL1h8/GPtUcmyMgluLB2dBQY?=
 =?us-ascii?Q?VqYBpdOujwh8geLytXZ1SvzjXLV34o/iUGhqC28YVqHNZmaxLnb21xoTsnvf?=
 =?us-ascii?Q?HEVTLlqtp/xeI8P135kpsHDxfs4SKjVt9frNH9+8UiEDW6TeM8A3hTVqpa9K?=
 =?us-ascii?Q?s/nMb9tGUTDDgAGf3K3/HLH9L0uk7cfuHUdWuQ2vn3b7kWsbqkH9oppth79J?=
 =?us-ascii?Q?k2toKQvr64zOX+DK52Ke+59HJjF6sJ0AlP5fj458FzVE90iyPWuahiDDZcet?=
 =?us-ascii?Q?daOGqCVBFheNoLLDJ0gEIL+urp20jCXSdzxTC4Hun0Ti7yIe+xEWfw+pk4jW?=
 =?us-ascii?Q?bhBlIGmxyejmUrnwEqrxz9roDP5cik8k8h4Cr1DC7uFiA/KOmx4Wahy/gZKC?=
 =?us-ascii?Q?ATHtpdx6eRqbKWxRDO9PPIVeECJ+ia5fXkQkpW9lQZygZ1c6NnAEhhux1BkA?=
 =?us-ascii?Q?4RekZKKKR1RPPcfIGYs8EJx5IHcie+2n3LYxONHalmGOGTxHT6ERPNbLaL86?=
 =?us-ascii?Q?ce2MsNvsXcBGuvFAAAEBno0EBXdRbEUbofquXGVwZHfaXbozKCRzIfQUjsRF?=
 =?us-ascii?Q?dtAr70QWY8gwDAXR6m3YxZH512BQsSUDhnGvMm9exo8HmClD1x5vOYCJ/LML?=
 =?us-ascii?Q?w9DIdWlrnYwSnU4FmOnEa1+mJnyl50RAOrgwJiC21RBkJJUBd5TUeGFceAum?=
 =?us-ascii?Q?QfQ6bsTH1yjKh99xSSCCdjnvcTUx+MiF1h12pNhvptiKkzQTPYRLzHCaGU8q?=
 =?us-ascii?Q?aYzUmQ5+eSmZn4xdpSAsgu9rj4zWkEKO3NwhXhkPHE/l0GixpVuqTvHl9Xzi?=
 =?us-ascii?Q?D4y1Lko/fFC050bFKrDYZFn2DN4bko1P0/UsLKKSbfQJCYuBjd4bqGXFAxN8?=
 =?us-ascii?Q?4FjNGRe5Hj1lRKIUfKmg0sBtcYX4JttuAsJjv5sdBBwZnV/qekU1lwMJ9/uM?=
 =?us-ascii?Q?qee61NOuKRm9iP8lZ1o3tM9roS+b7ms+RAU75fJG9LQvlj9c6p2YpxIj/0+d?=
 =?us-ascii?Q?OPay7yr4IeaXaLxDHQPU6wKSNOF8JbqYUr/9cO6MadwHLgS1kHijKhAG0XQO?=
 =?us-ascii?Q?FfWQuNKIr+D78W4PXjAz+XFlgRSyOzfJRMaFU2zrlk6ZsVNiJZnmS1oED1un?=
 =?us-ascii?Q?I5WRU80363mj7sMLGUJJtzjOVOIMrCpxtU+Jy28pA713d26tPq1INw0YlIXj?=
 =?us-ascii?Q?drfKF377cPG9pPQe7ebmkOsGpqEKkS5X11bG8WAX/ZruBR9Vm4lmGOubRfxr?=
 =?us-ascii?Q?5hQIME8aTYpchAcbGwAxeBg8CqREepEGWZ4w1u2izDOoXtm8Zx5OEWZXjA69?=
 =?us-ascii?Q?Py9raYNGZWlshO/59MHbUu4EAKgWhBrbddWJCrgEC8pO6SqahRpYZqAm5X8Z?=
 =?us-ascii?Q?dbt8DDq+SeiHFQhBUxTlCrZWP/glPrN/qeZb8rW7umxpIaPHkzegr/6uAIrs?=
 =?us-ascii?Q?eM11ccWCqdM+lOcmw/rCzSslsXO3nMeizc/r3tB6hlz2561iBlQpYDSPxQuA?=
 =?us-ascii?Q?Ry7J2Jrn92/lS+knSg1g85H6OOsBympUUyVV0YCaHkGjPkSpJm0K9n8iCYW4?=
 =?us-ascii?Q?vg=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 2a19cf17-9d4a-47f0-970d-08dab20a0551
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4429.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2022 19:42:13.6246
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: x9ZOzQ7AfrxTXddZEbcYzM7KR/hkI6CpUtXBBFsTaPShR1IoHm9W8ZNX/hajzm9Tz0sPayZhj/pBQdf42a5pag==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR10MB4403
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-10-19_11,2022-10-19_04,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 spamscore=0 bulkscore=0
 mlxscore=0 phishscore=0 suspectscore=0 adultscore=0 mlxlogscore=999
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000
 definitions=main-2210190110
X-Proofpoint-ORIG-GUID: if2cWKkDDXyUVOhr6OkWjVab0-zckgL6
X-Proofpoint-GUID: if2cWKkDDXyUVOhr6OkWjVab0-zckgL6
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Having stepped on a local kernel bug where reading sysfs has led to
out-of-bound pointer dereference by vsprintf() which led to GPF panic.
And the reason for GPF is that the OOB pointer was turned to a
non-canonical address such as 0x7665645f63616465.

vsprintf() already has this line of defense
	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
                return "(efault)";
Since a non-canonical pointer can be detected by kern_addr_valid()
on architectures that present VM holes as well as meaningful
implementation of kern_addr_valid() that detects the non-canonical
addresses, this patch adds a check on non-canonical string pointer by
kern_addr_valid() and "(efault)" to alert user that something
is wrong instead of unecessarily panic the server.

On the other hand, if the non-canonical string pointer is dereferenced
else where in the kernel, by virtue of being non-canonical, a crash
is expected to be immediate.

Signed-off-by: Jane Chu <jane.chu@oracle.com>
---
 lib/vsprintf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index c414a8d9f1ea..b38c12ef1e45 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -698,6 +698,9 @@ static const char *check_pointer_msg(const void *ptr)
 	if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr))
 		return "(efault)";
 
+	if (!kern_addr_valid((unsigned long)ptr))
+		return "(efault)";
+
 	return NULL;
 }
 
-- 
2.18.4