FM / scripts

/usr/src/kernels/4.18.0-553.157.1.el8_10.x86_64/scripts/

/usr/src/kernels/4.18.0-553.157.1.el8_10.x86_64/scripts

Name	Size	Mode	Actions
basic/	-	0755	rm
clang-tools/	-	0755	rm
coccinelle/	-	0755	rm
dtc/	-	0755	rm
gcc-plugins/	-	0755	rm
gdb/	-	0755	rm
genksyms/	-	0755	rm
kconfig/	-	0755	rm
ksymoops/	-	0755	rm
mod/	-	0755	rm
package/	-	0755	rm
selinux/	-	0755	rm
adjust_autoksyms.sh	3010	0755	edit dl rm
asn1_compiler	28008	0755	edit dl rm
asn1_compiler.c	36391	0644	edit dl rm
bin2c	7024	0755	edit dl rm
bin2c.c	743	0644	edit dl rm
bloat-o-meter	3313	0755	edit dl rm
bootgraph.pl	6426	0755	edit dl rm
bpf_doc.py	25515	0755	edit dl rm
cc-can-link.sh	166	0755	edit dl rm
checkincludes.pl	1984	0755	edit dl rm
checkkconfigsymbols.py	15895	0755	edit dl rm
checkpatch.pl	197186	0755	edit dl rm
checkstack.pl	5303	0755	edit dl rm
checksyscalls.sh	7094	0755	edit dl rm
checkversion.pl	1938	0755	edit dl rm
check_00index.sh	1333	0755	edit dl rm
check_extable.sh	5049	0755	edit dl rm
clang-version.sh	635	0755	edit dl rm
cleanfile	3538	0755	edit dl rm
cleanpatch	5178	0755	edit dl rm
coccicheck	7407	0755	edit dl rm
config	4635	0755	edit dl rm
conmakehash	11616	0755	edit dl rm
conmakehash.c	6128	0644	edit dl rm
const_structs.checkpatch	964	0644	edit dl rm
decodecode	2525	0755	edit dl rm
decode_stacktrace.sh	3834	0755	edit dl rm
depmod.sh	1119	0755	edit dl rm
diffconfig	3821	0755	edit dl rm
documentation-file-ref-check	3548	0755	edit dl rm
export_report.pl	4654	0755	edit dl rm
extract-cert	11616	0755	edit dl rm
extract-cert.c	3541	0644	edit dl rm
extract-ikconfig	1734	0755	edit dl rm
extract-module-sig.pl	3742	0755	edit dl rm
extract-sys-certs.pl	3832	0755	edit dl rm
extract-vmlinux	1725	0755	edit dl rm
extract_xc3028.pl	45665	0755	edit dl rm
faddr2line	6303	0755	edit dl rm
file-size.sh	86	0755	edit dl rm
find-unused-docs.sh	1310	0755	edit dl rm
gcc-goto.sh	530	0755	edit dl rm
gcc-ld	711	0755	edit dl rm
gcc-plugin.sh	1090	0755	edit dl rm
gcc-version.sh	857	0755	edit dl rm
gcc-x86_32-has-stack-protector.sh	173	0755	edit dl rm
gcc-x86_64-has-stack-protector.sh	198	0755	edit dl rm
gen_initramfs_list.sh	8224	0755	edit dl rm
get_dvb_firmware	25824	0755	edit dl rm
get_maintainer.pl	67369	0755	edit dl rm
gfp-translate	1752	0755	edit dl rm
headerdep.pl	3582	0755	edit dl rm
headers.sh	512	0755	edit dl rm
headers_check.pl	3815	0755	edit dl rm
headers_install.sh	1397	0755	edit dl rm
insert-sys-cert.c	9084	0644	edit dl rm
kallsyms	19992	0755	edit dl rm
kallsyms.c	18580	0644	edit dl rm
Kbuild.include	15468	0644	edit dl rm
Kconfig.include	1173	0644	edit dl rm
kernel-doc	62560	0755	edit dl rm
ld-version.sh	269	0755	edit dl rm
leaking_addresses.pl	13160	0755	edit dl rm
Lindent	502	0755	edit dl rm
link-vmlinux.sh	9176	0755	edit dl rm
Makefile	1741	0644	edit dl rm
Makefile.asm-generic	1193	0644	edit dl rm
Makefile.build	19707	0644	edit dl rm
Makefile.clean	2883	0644	edit dl rm
Makefile.dtbinst	1116	0644	edit dl rm
Makefile.extrawarn	2770	0644	edit dl rm
Makefile.gcc-plugins	1861	0644	edit dl rm
Makefile.headersinst	4079	0644	edit dl rm
Makefile.host	6520	0644	edit dl rm
Makefile.kasan	1679	0644	edit dl rm
Makefile.kcov	319	0644	edit dl rm
Makefile.kcsan	118	0644	edit dl rm
Makefile.lib	15535	0644	edit dl rm
Makefile.modbuiltin	1717	0644	edit dl rm
Makefile.modinst	1149	0644	edit dl rm
Makefile.modpost	5430	0644	edit dl rm
Makefile.modsign	897	0644	edit dl rm
Makefile.ubsan	951	0644	edit dl rm
makelst	808	0755	edit dl rm
markup_oops.pl	8273	0755	edit dl rm
mkcompile_h	2628	0755	edit dl rm
mkmakefile	1218	0755	edit dl rm
mksysmap	1359	0755	edit dl rm
mkuboot.sh	414	0755	edit dl rm
module-common.lds	901	0644	edit dl rm
modules.order	0	0644	edit dl rm
namespace.pl	13358	0755	edit dl rm
objdiff	2917	0755	edit dl rm
parse-maintainers.pl	4646	0755	edit dl rm
patch-kernel	10185	0755	edit dl rm
pnmtologo	15720	0755	edit dl rm
pnmtologo.c	12197	0644	edit dl rm
profile2linkerlist.pl	410	0755	edit dl rm
prune-kernel	708	0755	edit dl rm
recordmcount	24008	0755	edit dl rm
recordmcount.c	17062	0644	edit dl rm
recordmcount.h	16772	0644	edit dl rm
recordmcount.pl	18709	0755	edit dl rm
setlocalversion	4013	0755	edit dl rm
show_delta	3076	0755	edit dl rm
sign-file	15768	0755	edit dl rm
sign-file.c	9994	0644	edit dl rm
sortextable	15712	0755	edit dl rm
sortextable.c	10411	0644	edit dl rm
sortextable.h	5614	0644	edit dl rm
spelling.txt	25611	0644	edit dl rm
sphinx-pre-install	14378	0755	edit dl rm
split-man.pl	600	0755	edit dl rm
stackdelta	1883	0755	edit dl rm
stackusage	794	0755	edit dl rm
subarch.include	641	0644	edit dl rm
tags.sh	9789	0755	edit dl rm
test_fortify.sh	2281	0644	edit dl rm
unifdef	36192	0755	edit dl rm
unifdef.c	35637	0644	edit dl rm
ver_linux	2747	0755	edit dl rm
xen-hypercalls.sh	386	0644	edit dl rm
xz_wrap.sh	562	0755	edit dl rm

Edit: /usr/src/kernels/4.18.0-553.157.1.el8_10.x86_64/scripts/leaking_addresses.pl (13160B)

#!/usr/bin/perl
#
# (c) 2017 Tobin C. Harding <me@tobin.cc>
# Licensed under the terms of the GNU GPL License version 2
#
# leaking_addresses.pl: Scan the kernel for potential leaking addresses.
#  - Scans dmesg output.
#  - Walks directory tree and parses each file (for each directory in @DIRS).
#
# Use --debug to output path before parsing, this is useful to find files that
# cause the script to choke.

#
# When the system is idle it is likely that most files under /proc/PID will be
# identical for various processes.  Scanning _all_ the PIDs under /proc is
# unnecessary and implies that we are thoroughly scanning /proc.  This is _not_
# the case because there may be ways userspace can trigger creation of /proc
# files that leak addresses but were not present during a scan.  For these two
# reasons we exclude all PID directories under /proc except '1/'

use warnings;
use strict;
use POSIX;
use File::Basename;
use File::Spec;
use Cwd 'abs_path';
use Term::ANSIColor qw(:constants);
use Getopt::Long qw(:config no_auto_abbrev);
use Config;
use bigint qw/hex/;
use feature 'state';

my $P = $0;

# Directories to scan.
my @DIRS = ('/proc', '/sys');

# Timer for parsing each file, in seconds.
my $TIMEOUT = 10;

# Kernel addresses vary by architecture.  We can only auto-detect the following
# architectures (using `uname -m`).  (flag --32-bit overrides auto-detection.)
my @SUPPORTED_ARCHITECTURES = ('x86_64', 'ppc64', 'x86');

# Command line options.
my $help = 0;
my $debug = 0;
my $raw = 0;
my $output_raw = "";	# Write raw results to file.
my $input_raw = "";	# Read raw results from file instead of scanning.
my $suppress_dmesg = 0;		# Don't show dmesg in output.
my $squash_by_path = 0;		# Summary report grouped by absolute path.
my $squash_by_filename = 0;	# Summary report grouped by filename.
my $kernel_config_file = "";	# Kernel configuration file.
my $opt_32bit = 0;		# Scan 32-bit kernel.
my $page_offset_32bit = 0;	# Page offset for 32-bit kernel.

# Skip these absolute paths.
my @skip_abs = (
	'/proc/kmsg',
	'/proc/device-tree',
	'/proc/1/syscall',
	'/sys/firmware/devicetree',
	'/sys/kernel/debug/tracing/trace_pipe',
	'/sys/kernel/security/apparmor/revision');

# Skip these under any subdirectory.
my @skip_any = (
	'pagemap',
	'events',
	'access',
	'registers',
	'snapshot_raw',
	'trace_pipe_raw',
	'ptmx',
	'trace_pipe',
	'fd',
	'usbmon');

sub help
{
	my ($exitcode) = @_;

print << "EOM";

Usage: $P [OPTIONS]

Options:

-o, --output-raw=<file>		Save results for future processing.
	-i, --input-raw=<file>		Read results from file instead of scanning.
	      --raw			Show raw results (default).
	      --suppress-dmesg		Do not show dmesg results.
	      --squash-by-path		Show one result per unique path.
	      --squash-by-filename	Show one result per unique filename.
	--kernel-config-file=<file>     Kernel configuration file (e.g /boot/config)
	--32-bit			Scan 32-bit kernel.
	--page-offset-32-bit=o		Page offset (for 32-bit kernel 0xABCD1234).
	-d, --debug			Display debugging output.
	-h, --help, --version		Display this help and exit.

Scans the running kernel for potential leaking addresses.

EOM
	exit($exitcode);
}

GetOptions(
	'd|debug'		=> \$debug,
	'h|help'		=> \$help,
	'version'		=> \$help,
	'o|output-raw=s'        => \$output_raw,
	'i|input-raw=s'         => \$input_raw,
	'suppress-dmesg'        => \$suppress_dmesg,
	'squash-by-path'        => \$squash_by_path,
	'squash-by-filename'    => \$squash_by_filename,
	'raw'                   => \$raw,
	'kernel-config-file=s'	=> \$kernel_config_file,
	'32-bit'		=> \$opt_32bit,
	'page-offset-32-bit=o'	=> \$page_offset_32bit,
) or help(1);

help(0) if ($help);

if ($input_raw) {
	format_output($input_raw);
	exit(0);
}

if (!$input_raw and ($squash_by_path or $squash_by_filename)) {
	printf "\nSummary reporting only available with --input-raw=<file>\n";
	printf "(First run scan with --output-raw=<file>.)\n";
	exit(128);
}

if (!(is_supported_architecture() or $opt_32bit or $page_offset_32bit)) {
	printf "\nScript does not support your architecture, sorry.\n";
	printf "\nCurrently we support: \n\n";
	foreach(@SUPPORTED_ARCHITECTURES) {
		printf "\t%s\n", $_;
	}
	printf("\n");

printf("If you are running a 32-bit architecture you may use:\n");
	printf("\n\t--32-bit or --page-offset-32-bit=<page offset>\n\n");

my $archname = `uname -m`;
	printf("Machine hardware name (`uname -m`): %s\n", $archname);

exit(129);
}

if ($output_raw) {
	open my $fh, '>', $output_raw or die "$0: $output_raw: $!\n";
	select $fh;
}

parse_dmesg();
walk(@DIRS);

exit 0;

sub dprint
{
	printf(STDERR @_) if $debug;
}

sub is_supported_architecture
{
	return (is_x86_64() or is_ppc64() or is_ix86_32());
}

sub is_32bit
{
	# Allow --32-bit or --page-offset-32-bit to override
	if ($opt_32bit or $page_offset_32bit) {
		return 1;
	}

return is_ix86_32();
}

sub is_ix86_32
{
       state $arch = `uname -m`;

chomp $arch;
       if ($arch =~ m/i[3456]86/) {
               return 1;
       }
       return 0;
}

sub is_arch
{
       my ($desc) = @_;
       my $arch = `uname -m`;

chomp $arch;
       if ($arch eq $desc) {
               return 1;
       }
       return 0;
}

sub is_x86_64
{
	state $is = is_arch('x86_64');
	return $is;
}

sub is_ppc64
{
	state $is = is_arch('ppc64');
	return $is;
}

# Gets config option value from kernel config file.
# Returns "" on error or if config option not found.
sub get_kernel_config_option
{
	my ($option) = @_;
	my $value = "";
	my $tmp_file = "";
	my @config_files;

# Allow --kernel-config-file to override.
	if ($kernel_config_file ne "") {
		@config_files = ($kernel_config_file);
	} elsif (-R "/proc/config.gz") {
		my $tmp_file = "/tmp/tmpkconf";

if (system("gunzip < /proc/config.gz > $tmp_file")) {
			dprint "$0: system(gunzip < /proc/config.gz) failed\n";
			return "";
		} else {
			@config_files = ($tmp_file);
		}
	} else {
		my $file = '/boot/config-' . `uname -r`;
		chomp $file;
		@config_files = ($file, '/boot/config');
	}

foreach my $file (@config_files) {
		dprint("parsing config file: %s\n", $file);
		$value = option_from_file($option, $file);
		if ($value ne "") {
			last;
		}
	}

if ($tmp_file ne "") {
		system("rm -f $tmp_file");
	}

return $value;
}

# Parses $file and returns kernel configuration option value.
sub option_from_file
{
	my ($option, $file) = @_;
	my $str = "";
	my $val = "";

open(my $fh, "<", $file) or return "";
	while (my $line = <$fh> ) {
		if ($line =~ /^$option/) {
			($str, $val) = split /=/, $line;
			chomp $val;
			last;
		}
	}

close $fh;
	return $val;
}

sub is_false_positive
{
	my ($match) = @_;

if (is_32bit()) {
		return is_false_positive_32bit($match);
	}

# 64 bit false positives.

if ($match =~ '\b(0x)?(f|F){16}\b' or
	    $match =~ '\b(0x)?0{16}\b') {
		return 1;
	}

if (is_x86_64() and is_in_vsyscall_memory_region($match)) {
		return 1;
	}

return 0;
}

sub is_false_positive_32bit
{
       my ($match) = @_;
       state $page_offset = get_page_offset();

if ($match =~ '\b(0x)?(f|F){8}\b') {
               return 1;
       }

if (hex($match) < $page_offset) {
               return 1;
       }

return 0;
}

# returns integer value
sub get_page_offset
{
       my $page_offset;
       my $default_offset = 0xc0000000;

# Allow --page-offset-32bit to override.
       if ($page_offset_32bit != 0) {
               return $page_offset_32bit;
       }

$page_offset = get_kernel_config_option('CONFIG_PAGE_OFFSET');
       if (!$page_offset) {
	       return $default_offset;
       }
       return $page_offset;
}

sub is_in_vsyscall_memory_region
{
	my ($match) = @_;

my $hex = hex($match);
	my $region_min = hex("0xffffffffff600000");
	my $region_max = hex("0xffffffffff601000");

return ($hex >= $region_min and $hex <= $region_max);
}

# True if argument potentially contains a kernel address.
sub may_leak_address
{
	my ($line) = @_;
	my $address_re;

# Signal masks.
	if ($line =~ '^SigBlk:' or
	    $line =~ '^SigIgn:' or
	    $line =~ '^SigCgt:') {
		return 0;
	}

if ($line =~ '\bKEY=[[:xdigit:]]{14} [[:xdigit:]]{16} [[:xdigit:]]{16}\b' or
	    $line =~ '\b[[:xdigit:]]{14} [[:xdigit:]]{16} [[:xdigit:]]{16}\b') {
		return 0;
	}

$address_re = get_address_re();
	while ($line =~ /($address_re)/g) {
		if (!is_false_positive($1)) {
			return 1;
		}
	}

return 0;
}

sub get_address_re
{
	if (is_ppc64()) {
		return '\b(0x)?[89abcdef]00[[:xdigit:]]{13}\b';
	} elsif (is_32bit()) {
		return '\b(0x)?[[:xdigit:]]{8}\b';
	}

return get_x86_64_re();
}

sub get_x86_64_re
{
	# We handle page table levels but only if explicitly configured using
	# CONFIG_PGTABLE_LEVELS.  If config file parsing fails or config option
	# is not found we default to using address regular expression suitable
	# for 4 page table levels.
	state $ptl = get_kernel_config_option('CONFIG_PGTABLE_LEVELS');

if ($ptl == 5) {
		return '\b(0x)?ff[[:xdigit:]]{14}\b';
	}
	return '\b(0x)?ffff[[:xdigit:]]{12}\b';
}

sub parse_dmesg
{
	open my $cmd, '-|', 'dmesg';
	while (<$cmd>) {
		if (may_leak_address($_)) {
			print 'dmesg: ' . $_;
		}
	}
	close $cmd;
}

# True if we should skip this path.
sub skip
{
	my ($path) = @_;

foreach (@skip_abs) {
		return 1 if (/^$path$/);
	}

my($filename, $dirs, $suffix) = fileparse($path);
	foreach (@skip_any) {
		return 1 if (/^$filename$/);
	}

return 0;
}

sub timed_parse_file
{
	my ($file) = @_;

eval {
		local $SIG{ALRM} = sub { die "alarm\n" }; # NB: \n required.
		alarm $TIMEOUT;
		parse_file($file);
		alarm 0;
	};

if ($@) {
		die unless $@ eq "alarm\n";	# Propagate unexpected errors.
		printf STDERR "timed out parsing: %s\n", $file;
	}
}

sub parse_file
{
	my ($file) = @_;

if (! -R $file) {
		return;
	}

if (! -T $file) {
		return;
	}

open my $fh, "<", $file or return;
	while ( <$fh> ) {
		if (may_leak_address($_)) {
			print $file . ': ' . $_;
		}
	}
	close $fh;
}

# Checks if the actual path name is leaking a kernel address.
sub check_path_for_leaks
{
	my ($path) = @_;

if (may_leak_address($path)) {
		printf("Path name may contain address: $path\n");
	}
}

# Recursively walk directory tree.
sub walk
{
	my @dirs = @_;

while (my $pwd = shift @dirs) {
		next if (!opendir(DIR, $pwd));
		my @files = readdir(DIR);
		closedir(DIR);

foreach my $file (@files) {
			next if ($file eq '.' or $file eq '..');

my $path = "$pwd/$file";
			next if (-l $path);

# skip /proc/PID except /proc/1
			next if (($path =~ /^\/proc\/[0-9]+$/) &&
				 ($path !~ /^\/proc\/1$/));

next if (skip($path));

check_path_for_leaks($path);

if (-d $path) {
				push @dirs, $path;
				next;
			}

dprint "parsing: $path\n";
			timed_parse_file($path);
		}
	}
}

sub format_output
{
	my ($file) = @_;

# Default is to show raw results.
	if ($raw or (!$squash_by_path and !$squash_by_filename)) {
		dump_raw_output($file);
		return;
	}

my ($total, $dmesg, $paths, $files) = parse_raw_file($file);

printf "\nTotal number of results from scan (incl dmesg): %d\n", $total;

if (!$suppress_dmesg) {
		print_dmesg($dmesg);
	}

if ($squash_by_filename) {
		squash_by($files, 'filename');
	}

if ($squash_by_path) {
		squash_by($paths, 'path');
	}
}

sub dump_raw_output
{
	my ($file) = @_;

open (my $fh, '<', $file) or die "$0: $file: $!\n";
	while (<$fh>) {
		if ($suppress_dmesg) {
			if ("dmesg:" eq substr($_, 0, 6)) {
				next;
			}
		}
		print $_;
	}
	close $fh;
}

sub parse_raw_file
{
	my ($file) = @_;

my $total = 0;          # Total number of lines parsed.
	my @dmesg;              # dmesg output.
	my %files;              # Unique filenames containing leaks.
	my %paths;              # Unique paths containing leaks.

open (my $fh, '<', $file) or die "$0: $file: $!\n";
	while (my $line = <$fh>) {
		$total++;

if ("dmesg:" eq substr($line, 0, 6)) {
			push @dmesg, $line;
			next;
		}

cache_path(\%paths, $line);
		cache_filename(\%files, $line);
	}

return $total, \@dmesg, \%paths, \%files;
}

sub print_dmesg
{
	my ($dmesg) = @_;

print "\ndmesg output:\n";

if (@$dmesg == 0) {
		print "<no results>\n";
		return;
	}

foreach(@$dmesg) {
		my $index = index($_, ': ');
		$index += 2;    # skid ': '
		print substr($_, $index);
	}
}

sub squash_by
{
	my ($ref, $desc) = @_;

print "\nResults squashed by $desc (excl dmesg). ";
	print "Displaying [<number of results> <$desc>], <example result>\n";

if (keys %$ref == 0) {
		print "<no results>\n";
		return;
	}

foreach(keys %$ref) {
		my $lines = $ref->{$_};
		my $length = @$lines;
		printf "[%d %s] %s", $length, $_, @$lines[0];
	}
}

sub cache_path
{
	my ($paths, $line) = @_;

my $index = index($line, ': ');
	my $path = substr($line, 0, $index);

$index += 2;            # skip ': '
	add_to_cache($paths, $path, substr($line, $index));
}

sub cache_filename
{
	my ($files, $line) = @_;

my $index = index($line, ': ');
	my $path = substr($line, 0, $index);
	my $filename = basename($path);

$index += 2;            # skip ': '
	add_to_cache($files, $filename, substr($line, $index));
}

sub add_to_cache
{
	my ($cache, $key, $value) = @_;

if (!$cache->{$key}) {
		$cache->{$key} = ();
	}
	push @{$cache->{$key}}, $value;
}

cmd: