Messages in this thread Patch in this message | | | From | Jane Chu <> | Subject | [PATCH] vsprintf: protect kernel from panic due to non-canonical pointer dereference | Date | Mon, 17 Oct 2022 13:16:11 -0600 |
| |
While debugging a separate issue, it was found that an invalid string pointer could very well contain a non-canical address, such as 0x7665645f63616465. In that case, this line of defense isn't enough to protect the kernel from crashing due to general protection fault
if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr)) return "(efault)";
So instead, use kern_addr_valid() to validate the string pointer.
Signed-off-by: Jane Chu <jane.chu@oracle.com> --- lib/vsprintf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/vsprintf.c b/lib/vsprintf.c index c414a8d9f1ea..2e8a9efc7c12 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -695,7 +695,7 @@ static const char *check_pointer_msg(const void *ptr) if (!ptr) return "(null)"; - if ((unsigned long)ptr < PAGE_SIZE || IS_ERR_VALUE(ptr)) + if (!kern_addr_valid((unsigned long)ptr)) return "(efault)"; return NULL; -- 2.18.4
| |