From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753937AbcCHFN7 (ORCPT ); Tue, 8 Mar 2016 00:13:59 -0500 Received: from mx1.redhat.com ([209.132.183.28]:55957 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751839AbcCHFNw (ORCPT ); Tue, 8 Mar 2016 00:13:52 -0500 Date: Tue, 8 Mar 2016 13:13:42 +0800 From: Baoquan He To: Kees Cook Cc: LKML , Yinghai Lu , "H. Peter Anvin" , Vivek Goyal , Ingo Molnar , Borislav Petkov , Andy Lutomirski , lasse.collin@tukaani.org, Andrew Morton , Dave Young Subject: Re: [PATCH v3 07/19] x86, kaslr: Get correct max_addr for relocs pointer Message-ID: <20160308051342.GD2481@x1.redhat.com> References: <1457108717-12191-1-git-send-email-bhe@redhat.com> <1457108717-12191-8-git-send-email-bhe@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 03/07/16 at 03:16pm, Kees Cook wrote: > On Fri, Mar 4, 2016 at 8:25 AM, Baoquan He wrote: > > From: Yinghai Lu > > > > There is boundary checking for pointer in kaslr relocation handling. > > > > Current code is using output_len, and that is VO (vmlinux after objcopy) > > file size plus vmlinux.relocs file size. > > > > That is not right, as we should use loaded address for running. > > I think this needs clarification. If I'm understanding correctly, the > max_addr check should stop at the end of VO, and not include bss, brk, > etc. which follows. In which case, this change is correct: the bounds > checking needed to be tightened. Yes, exactly as you means. > > > > > > At that time parse_elf already move the sections according to ELF headers. > > > > The valid range should be VO [_text, __bss_start) loaded physical addresses. I think it is expressed here. Maybe we can stress it in this patch log. After all it's the main idea of this patch. How about rewriting patch log like this: ******************** There is boundary checking for pointer in kaslr relocation handling. However current code is using output_len that is VO (vmlinux after objcopy) file size plus vmlinux.relocs file size to make the valid boundary. That is not right since the max_addr check should stop at the end of VO and excludes bss, brk etc, which follows. Means the valid range should be VO [_text, __bss_start] in loaded physical address space. In this patch, add export for __bss_start to voffset.h and use it to get max_addr. ******************** > > > > In the patch, add export for __bss_start to voffset.h and use it to get > > max_addr. > > > > Signed-off-by: Yinghai Lu > > --- > > v2->v3: > > Tune the patch log. > > > > arch/x86/boot/compressed/Makefile | 2 +- > > arch/x86/boot/compressed/misc.c | 2 +- > > 2 files changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile > > index fef80fa..2e7c0ce 100644 > > --- a/arch/x86/boot/compressed/Makefile > > +++ b/arch/x86/boot/compressed/Makefile > > @@ -41,7 +41,7 @@ LDFLAGS_vmlinux := -T > > hostprogs-y := mkpiggy > > HOST_EXTRACFLAGS += -I$(srctree)/tools/include > > > > -sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' > > +sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' > > > > quiet_cmd_voffset = VOFFSET $@ > > cmd_voffset = $(NM) $< | sed -n $(sed-voffset) > $@ > > diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c > > index 069120e..dd7ed8a 100644 > > --- a/arch/x86/boot/compressed/misc.c > > +++ b/arch/x86/boot/compressed/misc.c > > @@ -259,7 +259,7 @@ static void handle_relocations(void *output, unsigned long output_len) > > int *reloc; > > unsigned long delta, map, ptr; > > unsigned long min_addr = (unsigned long)output; > > - unsigned long max_addr = min_addr + output_len; > > + unsigned long max_addr = min_addr + (VO___bss_start - VO__text); > > > > /* > > * Calculate the delta between where vmlinux was linked to load > > -- > > 2.5.0 > > > > > > -- > Kees Cook > Chrome OS & Brillo Security