Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707#!/usr/bin/env perl# SPDX-License-Identifier: GPL-2.0-only## (c) 2017 Tobin C. Harding <me@tobin.cc>## leaking_addresses.pl: Scan the kernel for potential leaking addresses.# - Scans dmesg output.# - Walks directory tree and parses each file (for each directory in @DIRS).## Use --debug to output path before parsing, this is useful to find files that# cause the script to choke.
## When the system is idle it is likely that most files under /proc/PID will be# identical for various processes. Scanning _all_ the PIDs under /proc is# unnecessary and implies that we are thoroughly scanning /proc. This is _not_# the case because there may be ways userspace can trigger creation of /proc# files that leak addresses but were not present during a scan. For these two# reasons we exclude all PID directories under /proc except '1/'
use warnings;use strict;use POSIX;use File::Basename;use File::Spec;use File::Temp qw/tempfile/;use Cwd 'abs_path';use Term::ANSIColor qw(:constants);use Getopt::Long qw(:config no_auto_abbrev);use Config;use bigint qw/hex/;use feature 'state';
my $P = $0;
# Directories to scan.my @DIRS = ('/proc', '/sys');
# Timer for parsing each file, in seconds.my $TIMEOUT = 10;
# Kernel addresses vary by architecture. We can only auto-detect the following# architectures (using `uname -m`). (flag --32-bit overrides auto-detection.)my @SUPPORTED_ARCHITECTURES = ('x86_64', 'ppc64', 'x86');
# Command line options.my $help = 0;my $debug = 0;my $raw = 0;my $output_raw = ""; # Write raw results to file.my $input_raw = ""; # Read raw results from file instead of scanning.my $suppress_dmesg = 0; # Don't show dmesg in output.my $squash_by_path = 0; # Summary report grouped by absolute path.my $squash_by_filename = 0; # Summary report grouped by filename.my $kallsyms_file = ""; # Kernel symbols file.my $kernel_config_file = ""; # Kernel configuration file.my $opt_32bit = 0; # Scan 32-bit kernel.my $page_offset_32bit = 0; # Page offset for 32-bit kernel.
my @kallsyms = ();
# Skip these absolute paths.my @skip_abs = ( '/proc/kmsg', '/proc/device-tree', '/proc/1/syscall', '/sys/firmware/devicetree', '/sys/kernel/tracing/trace_pipe', '/sys/kernel/debug/tracing/trace_pipe', '/sys/kernel/security/apparmor/revision');
# Skip these under any subdirectory.my @skip_any = ( 'pagemap', 'events', 'access', 'registers', 'snapshot_raw', 'trace_pipe_raw', 'ptmx', 'trace_pipe', 'fd', 'usbmon');
sub help{ my ($exitcode) = @_;
print << "EOM";
Usage: $P [OPTIONS]
Options:
-o, --output-raw=<file> Save results for future processing. -i, --input-raw=<file> Read results from file instead of scanning. --raw Show raw results (default). --suppress-dmesg Do not show dmesg results. --squash-by-path Show one result per unique path. --squash-by-filename Show one result per unique filename. --kernel-config-file=<file> Kernel configuration file (e.g /boot/config) --kallsyms=<file> Read kernel symbol addresses from file (for scanning binary files). --32-bit Scan 32-bit kernel. --page-offset-32-bit=o Page offset (for 32-bit kernel 0xABCD1234). -d, --debug Display debugging output. -h, --help Display this help and exit.
Scans the running kernel for potential leaking addresses.
EOM exit($exitcode);}
GetOptions( 'd|debug' => \$debug, 'h|help' => \$help, 'o|output-raw=s' => \$output_raw, 'i|input-raw=s' => \$input_raw, 'suppress-dmesg' => \$suppress_dmesg, 'squash-by-path' => \$squash_by_path, 'squash-by-filename' => \$squash_by_filename, 'raw' => \$raw, 'kallsyms=s' => \$kallsyms_file, 'kernel-config-file=s' => \$kernel_config_file, '32-bit' => \$opt_32bit, 'page-offset-32-bit=o' => \$page_offset_32bit,) or help(1);
help(0) if ($help);
if ($input_raw) { format_output($input_raw); exit(0);}
if (!$input_raw and ($squash_by_path or $squash_by_filename)) { printf "\nSummary reporting only available with --input-raw=<file>\n"; printf "(First run scan with --output-raw=<file>.)\n"; exit(128);}
if (!(is_supported_architecture() or $opt_32bit or $page_offset_32bit)) { printf "\nScript does not support your architecture, sorry.\n"; printf "\nCurrently we support: \n\n"; foreach(@SUPPORTED_ARCHITECTURES) { printf "\t%s\n", $_; } printf("\n");
printf("If you are running a 32-bit architecture you may use:\n"); printf("\n\t--32-bit or --page-offset-32-bit=<page offset>\n\n");
my $archname = `uname -m`; printf("Machine hardware name (`uname -m`): %s\n", $archname);
exit(129);}
if ($output_raw) { open my $fh, '>', $output_raw or die "$0: $output_raw: $!\n"; select $fh;}
if ($kallsyms_file) { open my $fh, '<', $kallsyms_file or die "$0: $kallsyms_file: $!\n"; while (<$fh>) { chomp; my @entry = split / /, $_; my $addr_text = $entry[0]; if ($addr_text !~ /^0/) { # TODO: Why is hex() so impossibly slow? my $addr = hex($addr_text); my $symbol = $entry[2]; # Only keep kernel text addresses. my $long = pack("J", $addr); my $entry = [$long, $symbol]; push @kallsyms, $entry; } } close $fh;}
parse_dmesg();walk(@DIRS);
exit 0;
sub dprint{ printf(STDERR @_) if $debug;}
sub is_supported_architecture{ return (is_x86_64() or is_ppc64() or is_ix86_32());}
sub is_32bit{ # Allow --32-bit or --page-offset-32-bit to override if ($opt_32bit or $page_offset_32bit) { return 1; }
return is_ix86_32();}
sub is_ix86_32{ state $arch = `uname -m`;
chomp $arch; if ($arch =~ m/i[3456]86/) { return 1; } return 0;}
sub is_arch{ my ($desc) = @_; my $arch = `uname -m`;
chomp $arch; if ($arch eq $desc) { return 1; } return 0;}
sub is_x86_64{ state $is = is_arch('x86_64'); return $is;}
sub is_ppc64{ state $is = is_arch('ppc64'); return $is;}
# Gets config option value from kernel config file.# Returns "" on error or if config option not found.sub get_kernel_config_option{ my ($option) = @_; my $value = ""; my $tmp_fh; my $tmp_file = ""; my @config_files;
# Allow --kernel-config-file to override. if ($kernel_config_file ne "") { @config_files = ($kernel_config_file); } elsif (-R "/proc/config.gz") { ($tmp_fh, $tmp_file) = tempfile("config.gz-XXXXXX", UNLINK => 1);
if (system("gunzip < /proc/config.gz > $tmp_file")) { dprint("system(gunzip < /proc/config.gz) failed\n"); return ""; } else { @config_files = ($tmp_file); } } else { my $file = '/boot/config-' . `uname -r`; chomp $file; @config_files = ($file, '/boot/config'); }
foreach my $file (@config_files) { dprint("parsing config file: $file\n"); $value = option_from_file($option, $file); if ($value ne "") { last; } }
return $value;}
# Parses $file and returns kernel configuration option value.sub option_from_file{ my ($option, $file) = @_; my $str = ""; my $val = "";
open(my $fh, "<", $file) or return ""; while (my $line = <$fh> ) { if ($line =~ /^$option/) { ($str, $val) = split /=/, $line; chomp $val; last; } }
close $fh; return $val;}
sub is_false_positive{ my ($match) = @_;
if (is_32bit()) { return is_false_positive_32bit($match); }
# Ignore 64 bit false positives: # 0xfffffffffffffff[0-f] # 0x0000000000000000 if ($match =~ '\b(0x)?(f|F){15}[0-9a-f]\b' or $match =~ '\b(0x)?0{16}\b') { return 1; }
if (is_x86_64() and is_in_vsyscall_memory_region($match)) { return 1; }
return 0;}
sub is_false_positive_32bit{ my ($match) = @_; state $page_offset = get_page_offset();
if ($match =~ '\b(0x)?(f|F){7}[0-9a-f]\b') { return 1; }
if (hex($match) < $page_offset) { return 1; }
return 0;}
# returns integer valuesub get_page_offset{ my $page_offset; my $default_offset = 0xc0000000;
# Allow --page-offset-32bit to override. if ($page_offset_32bit != 0) { return $page_offset_32bit; }
$page_offset = get_kernel_config_option('CONFIG_PAGE_OFFSET'); if (!$page_offset) { return $default_offset; } return $page_offset;}
sub is_in_vsyscall_memory_region{ my ($match) = @_;
my $hex = hex($match); my $region_min = hex("0xffffffffff600000"); my $region_max = hex("0xffffffffff601000");
return ($hex >= $region_min and $hex <= $region_max);}
# True if argument potentially contains a kernel address.sub may_leak_address{ my ($path, $line) = @_; my $address_re;
# Ignore Signal masks. if ($line =~ '^SigBlk:' or $line =~ '^SigIgn:' or $line =~ '^SigCgt:') { return 0; }
# Ignore input device reporting. # /proc/bus/input/devices: B: KEY=402000000 3803078f800d001 feffffdfffefffff fffffffffffffffe # /sys/devices/platform/i8042/serio0/input/input1/uevent: KEY=402000000 3803078f800d001 feffffdfffefffff fffffffffffffffe # /sys/devices/platform/i8042/serio0/input/input1/capabilities/key: 402000000 3803078f800d001 feffffdfffefffff fffffffffffffffe if ($line =~ '\bKEY=[[:xdigit:]]{9,14} [[:xdigit:]]{16} [[:xdigit:]]{16}\b' or ($path =~ '\bkey$' and $line =~ '\b[[:xdigit:]]{9,14} [[:xdigit:]]{16} [[:xdigit:]]{16}\b')) { return 0; }
$address_re = get_address_re(); while ($line =~ /($address_re)/g) { if (!is_false_positive($1)) { return 1; } }
return 0;}
sub get_address_re{ if (is_ppc64()) { return '\b(0x)?[89abcdef]00[[:xdigit:]]{13}\b'; } elsif (is_32bit()) { return '\b(0x)?[[:xdigit:]]{8}\b'; }
return get_x86_64_re();}
sub get_x86_64_re{ # We handle page table levels but only if explicitly configured using # CONFIG_PGTABLE_LEVELS. If config file parsing fails or config option # is not found we default to using address regular expression suitable # for 4 page table levels. state $ptl = get_kernel_config_option('CONFIG_PGTABLE_LEVELS');
if ($ptl == 5) { return '\b(0x)?ff[[:xdigit:]]{14}\b'; } return '\b(0x)?ffff[[:xdigit:]]{12}\b';}
sub parse_dmesg{ open my $cmd, '-|', 'dmesg'; while (<$cmd>) { if (may_leak_address("dmesg", $_)) { print 'dmesg: ' . $_; } } close $cmd;}
# True if we should skip this path.sub skip{ my ($path) = @_;
foreach (@skip_abs) { return 1 if (/^$path$/); }
my($filename, $dirs, $suffix) = fileparse($path); foreach (@skip_any) { return 1 if (/^$filename$/); }
return 0;}
sub timed_parse_file{ my ($file) = @_;
eval { local $SIG{ALRM} = sub { die "alarm\n" }; # NB: \n required. alarm $TIMEOUT; parse_file($file); alarm 0; };
if ($@) { die unless $@ eq "alarm\n"; # Propagate unexpected errors. printf STDERR "timed out parsing: %s\n", $file; }}
sub parse_binary{ my ($file) = @_;
open my $fh, "<:raw", $file or return; local $/ = undef; my $bytes = <$fh>; close $fh;
foreach my $entry (@kallsyms) { my $addr = $entry->[0]; my $symbol = $entry->[1]; my $offset = index($bytes, $addr); if ($offset != -1) { printf("$file: $symbol @ $offset\n"); } }}
sub parse_file{ my ($file) = @_;
if (! -R $file) { return; }
if (! -T $file) { if ($file =~ m|^/sys/kernel/btf/| or $file =~ m|^/sys/devices/pci| or $file =~ m|^/sys/firmware/efi/efivars/| or $file =~ m|^/proc/bus/pci/|) { return; } if (scalar @kallsyms > 0) { parse_binary($file); } return; }
open my $fh, "<", $file or return; while ( <$fh> ) { chomp; if (may_leak_address($file, $_)) { printf("$file: $_\n"); } } close $fh;}
# Checks if the actual path name is leaking a kernel address.sub check_path_for_leaks{ my ($path) = @_;
if (may_leak_address($path, $path)) { printf("Path name may contain address: $path\n"); }}
# Recursively walk directory tree.sub walk{ my @dirs = @_;
while (my $pwd = shift @dirs) { next if (!opendir(DIR, $pwd)); my @files = readdir(DIR); closedir(DIR);
foreach my $file (@files) { next if ($file eq '.' or $file eq '..');
my $path = "$pwd/$file"; next if (-l $path);
# skip /proc/PID except /proc/1 next if (($path =~ /^\/proc\/[0-9]+$/) && ($path !~ /^\/proc\/1$/));
next if (skip($path));
check_path_for_leaks($path);
if (-d $path) { push @dirs, $path; next; }
dprint("parsing: $path\n"); timed_parse_file($path); } }}
sub format_output{ my ($file) = @_;
# Default is to show raw results. if ($raw or (!$squash_by_path and !$squash_by_filename)) { dump_raw_output($file); return; }
my ($total, $dmesg, $paths, $files) = parse_raw_file($file);
printf "\nTotal number of results from scan (incl dmesg): %d\n", $total;
if (!$suppress_dmesg) { print_dmesg($dmesg); }
if ($squash_by_filename) { squash_by($files, 'filename'); }
if ($squash_by_path) { squash_by($paths, 'path'); }}
sub dump_raw_output{ my ($file) = @_;
open (my $fh, '<', $file) or die "$0: $file: $!\n"; while (<$fh>) { if ($suppress_dmesg) { if ("dmesg:" eq substr($_, 0, 6)) { next; } } print $_; } close $fh;}
sub parse_raw_file{ my ($file) = @_;
my $total = 0; # Total number of lines parsed. my @dmesg; # dmesg output. my %files; # Unique filenames containing leaks. my %paths; # Unique paths containing leaks.
open (my $fh, '<', $file) or die "$0: $file: $!\n"; while (my $line = <$fh>) { $total++;
if ("dmesg:" eq substr($line, 0, 6)) { push @dmesg, $line; next; }
cache_path(\%paths, $line); cache_filename(\%files, $line); }
return $total, \@dmesg, \%paths, \%files;}
sub print_dmesg{ my ($dmesg) = @_;
print "\ndmesg output:\n";
if (@$dmesg == 0) { print "<no results>\n"; return; }
foreach(@$dmesg) { my $index = index($_, ': '); $index += 2; # skid ': ' print substr($_, $index); }}
sub squash_by{ my ($ref, $desc) = @_;
print "\nResults squashed by $desc (excl dmesg). "; print "Displaying [<number of results> <$desc>], <example result>\n";
if (keys %$ref == 0) { print "<no results>\n"; return; }
foreach(keys %$ref) { my $lines = $ref->{$_}; my $length = @$lines; printf "[%d %s] %s", $length, $_, @$lines[0]; }}
sub cache_path{ my ($paths, $line) = @_;
my $index = index($line, ': '); my $path = substr($line, 0, $index);
$index += 2; # skip ': ' add_to_cache($paths, $path, substr($line, $index));}
sub cache_filename{ my ($files, $line) = @_;
my $index = index($line, ': '); my $path = substr($line, 0, $index); my $filename = basename($path);
$index += 2; # skip ': ' add_to_cache($files, $filename, substr($line, $index));}
sub add_to_cache{ my ($cache, $key, $value) = @_;
if (!$cache->{$key}) { $cache->{$key} = (); } push @{$cache->{$key}}, $value;}