drm: do not leak kernel addresses via /proc/dri/*/vma
Subsystems (2)
PATCH 1/1 drm: do not leak kernel addresses via /proc/dri/*/vma
In the continuing effort to avoid kernel addresses leaking to unprivileged users, this patch switches to %pK for /proc/dri/*/vma.
--- drivers/gpu/drm/drm_info.c | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/drm_info.c +5 -4
@@ -283,17 +283,18 @@ int drm_vma_info(struct seq_file *m, void *data)#endif mutex_lock (&dev->struct_mutex); -seq_printf (m,"vma use count: %d, high_memory = %p, 0x%08llx\n" , +seq_printf (m,"vma use count: %d, high_memory = %pK, 0x%pK\n" ,atomic_read (&dev->vma_count), - high_memory, (u64 )virt_to_phys (high_memory)); + high_memory, (void *)virt_to_phys (high_memory));list_for_each_entry (pt, &dev->vmalist, head) { vma = pt->vma;if (!vma)continue ; seq_printf(m, - "\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000", - pt->pid, vma->vm_start, vma->vm_end, + "\n%5d 0x%pK-0x%pK %c%c%c%c%c%c 0x%08lx000", + pt->pid, + (void *)vma->vm_start, (void *)vma->vm_end, vma->vm_flags & VM_READ ? 'r' : '-', vma->vm_flags & VM_WRITE ? 'w' : '-', vma->vm_flags & VM_EXEC ? 'x' : '-',
Signature · 5 lines
1.7.2.3 -- Kees Cook Ubuntu Security Team
Quoted 36 lines · Kees Cook
In the continuing effort to avoid kernel addresses leaking to unprivileged users, this patch switches to %pK for
/proc/dri/*/vma.Signed-off-by Kees Cook <[email protected]>---
drivers/gpu/drm/drm_info.c | 9 +++++----1 files changed, 5 insertions(+), 4 deletions(-)drivers/gpu/drm/drm_info.c +5
-5@@ -283,17 +283,18 @@ int drm_vma_info(struct seq_file *m, void *data) #endif mutex_lock(&dev->struct_mutex); - seq_printf(m, "vma use count: %d, high_memory = %p, 0x%08llx\n", + seq_printf(m, "vma use count: %d, high_memory = %pK, 0x%pK\n", atomic_read(&dev->vma_count), - high_memory, (u64)virt_to_phys(high_memory)); + high_memory, (void *)virt_to_phys(high_memory)); list_for_each_entry(pt, &dev->vmalist, head) { vma = pt->vma; if (!vma) continue; seq_printf(m, - "\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000", - pt->pid, vma->vm_start, vma->vm_end, + "\n%5d 0x%pK-0x%pK %c%c%c%c%c%c 0x%08lx000", + pt->pid, + (void *)vma->vm_start, (void *)vma->vm_end, vma->vm_flags & VM_READ ? 'r' : '-', vma->vm_flags & VM_WRITE ? 'w' : '-', vma->vm_flags & VM_EXEC ? 'x' : '-', --
Quoted 1 line
1.7.2.3
This is a highly reasonable patch. Does 0x%pK show up as 0x0x0 in the log, or just 0x0? Other than that...
Signature · 4 lines
When the facts change, I change my mind. What do you do, sir? ~ Keynes Corbin Simpson <[email protected]>
Hi Corbin,
Quoted 7 lines · Corbin Simpson
Quoted 2 lines · Kees Cook
In the continuing effort to avoid kernel addresses leaking to unprivileged users, this patch switches to %pK for
/proc/dri/*/vma.This is a highly reasonable patch. Does 0x%pK show up as 0x0x0 in the log, or just
0x0? Other than that...Reviewed-by Corbin Simpson <[email protected]>
Thanks! The default for %p (and %pK) is without the 0x prefix, and 0-padded to sizeof(void*) character. So 0x%pK will show as 0x00000000 on 32bit to a regular user, etc.
-Kees
Signature · 2 lines
Kees Cook Ubuntu Security Team