On Wed, 25 Jul 2018 13:22:36 -0700 Mark Salyzyn salyzyn@android.com wrote:
From: Nick Desaulniers ndesaulniers@google.com
Switch from 0x%lx to 0x%pK to print the kernel addresses.
Fixes: CVE-2017-0630
Wait!!!! This breaks perf and trace-cmd! They require this to be able to print various strings in trace events. This file is root read only, as the CVE says.
NAK for this fix. Come up with something that doesn't break perf and trace-cmd. That will not be trivial, as the format is stored in the ring buffer with an address, then referenced directly. It also handles trace_printk() functions that simply point to the string format itself.
A fix would require having a pointer be the same that is referenced inside the kernel as well as in this file. Maybe make the format string placed in a location that doesn't leak where the rest of the kernel exists?
-- Steve
Signed-off-by: Mark Salyzyn salyzyn@android.com Cc: Nick Desaulniers ndesaulniers@google.com Cc: Steven Rostedt rostedt@goodmis.org Cc: Ingo Molnar mingo@redhat.com Cc: kernel-team@android.com Cc: stable@vger.kernel.org # 3.18, 4.4, 4.9, 4.14 Cc: linux-kernel@vger.kernel.org
kernel/trace/trace_printk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c index ad1d6164e946..93698023baf1 100644 --- a/kernel/trace/trace_printk.c +++ b/kernel/trace/trace_printk.c @@ -304,7 +304,7 @@ static int t_show(struct seq_file *m, void *v) if (!*fmt) return 0;
- seq_printf(m, "0x%lx : "", *(unsigned long *)fmt);
- seq_printf(m, "0x%pK : "", *(unsigned long *)fmt);
/* * Tabs and new lines need to be converted.