> -----Original Message----- > From: Rasmus Villemoes [mailto:linux@xxxxxxxxxxxxxxxxxx] > Sent: Wednesday, October 5, 2016 4:53 PM > To: Roberts, William C <william.c.roberts@xxxxxxxxx> > Cc: kernel-hardening@xxxxxxxxxxxxxxxxxx; corbet@xxxxxxx; linux- > doc@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx > Subject: Re: [PATCH] printk: introduce kptr_restrict level 3 > > On Wed, Oct 05 2016, william.c.roberts@xxxxxxxxx wrote: > > > From: William Roberts <william.c.roberts@xxxxxxxxx> > > > > Some out-of-tree modules do not use %pK and just use %p, as it's the > > common C paradigm for printing pointers. Because of this, > > kptr_restrict has no affect on the output and thus, no way to contain > > the kernel address leak. > > > > Introduce kptr_restrict level 3 that causes the kernel to treat %p as > > if it was %pK and thus always prints zeros. > > > > Sample Output: > > kptr_restrict == 2: > > p: 00000000604369f4 > > pK: 0000000000000000 > > > > kptr_restrict == 3: > > p: 0000000000000000 > > pK: 0000000000000000 > > > > Signed-off-by: William Roberts <william.c.roberts@xxxxxxxxx> > > --- > > Documentation/sysctl/kernel.txt | 3 ++ > > kernel/sysctl.c | 3 +- > > lib/vsprintf.c | 107 ++++++++++++++++++++++++---------------- > > That's a lot of changed lines. Why isn't this just I moved the nested case into a static local function, I thought it was easier to read than the existing nested switches. The other reason was so we didn't have kptr_restrict littering that code and it was contained within the default and K values of the switch. > > --- a/lib/vsprintf.c > +++ b/lib/vsprintf.c > @@ -1719,6 +1719,8 @@ char *pointer(const char *fmt, char *buf, char *end, > void *ptr, > case 'G': > return flags_string(buf, end, ptr, fmt); > } > + if (kptr_restrict == 3) > + ptr = NULL; > spec.flags |= SMALL; > if (spec.field_width == -1) { > spec.field_width = default_width; > > ? -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
