From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com Sender: Ingo Molnar Date: Thu, 12 May 2016 10:31:42 +0200 From: Ingo Molnar Message-ID: <20160512083142.GB26457@gmail.com> References: <1462900755-20005-1-git-send-email-keescook@chromium.org> <1462900755-20005-2-git-send-email-keescook@chromium.org> <20160511062442.GA24803@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Subject: [kernel-hardening] Re: [PATCH v8 1/4] x86/KASLR: Clarify identity map interface To: Kees Cook Cc: Borislav Petkov , Yinghai Lu , Baoquan He , Ingo Molnar , "H. Peter Anvin" , Borislav Petkov , Vivek Goyal , Andy Lutomirski , Lasse Collin , Andrew Morton , Dave Young , "kernel-hardening@lists.openwall.com" , LKML List-ID: * Kees Cook wrote: > On Tue, May 10, 2016 at 11:24 PM, Ingo Molnar wrote: > > > > * Kees Cook wrote: > > > >> +/* > >> + * Mapping information structure passed to kernel_ident_mapping_init(). > >> + * Due to relocation, pointers must be assigned at run time not build time. > >> + */ > >> +static struct x86_mapping_info mapping_info = { > >> + .pmd_flag = __PAGE_KERNEL_LARGE_EXEC, > >> +}; > > > >> +void initialize_identity_maps(void) > >> { > >> + /* Init mapping_info with run-time function/buffer pointers. */ > >> + mapping_info.alloc_pgt_page = alloc_pgt_page; > >> + mapping_info.context = &pgt_data; > > > > Could you please outline the precise failure mode? What gets executed when, which > > pointer gets relocated and which not, and exactly when does it pose a problem, > > etc. > > It's the issue described at the top of misc.c: > > /* > * WARNING!! > * This code is compiled with -fPIC and it is relocated dynamically at > * run time, but no relocation processing is performed. This means that > * it is not safe to place pointers in static structures. > */ Btw., is there any way to detect such invalid pointers during build-time somehow? This is not the first such bug and I suspect it won't be the last one either. Thanks, Ingo From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752702AbcELIbu (ORCPT ); Thu, 12 May 2016 04:31:50 -0400 Received: from mail-wm0-f65.google.com ([74.125.82.65]:34207 "EHLO mail-wm0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752546AbcELIbr (ORCPT ); Thu, 12 May 2016 04:31:47 -0400 Date: Thu, 12 May 2016 10:31:42 +0200 From: Ingo Molnar To: Kees Cook Cc: Borislav Petkov , Yinghai Lu , Baoquan He , Ingo Molnar , "H. Peter Anvin" , Borislav Petkov , Vivek Goyal , Andy Lutomirski , Lasse Collin , Andrew Morton , Dave Young , "kernel-hardening@lists.openwall.com" , LKML Subject: Re: [PATCH v8 1/4] x86/KASLR: Clarify identity map interface Message-ID: <20160512083142.GB26457@gmail.com> References: <1462900755-20005-1-git-send-email-keescook@chromium.org> <1462900755-20005-2-git-send-email-keescook@chromium.org> <20160511062442.GA24803@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org * Kees Cook wrote: > On Tue, May 10, 2016 at 11:24 PM, Ingo Molnar wrote: > > > > * Kees Cook wrote: > > > >> +/* > >> + * Mapping information structure passed to kernel_ident_mapping_init(). > >> + * Due to relocation, pointers must be assigned at run time not build time. > >> + */ > >> +static struct x86_mapping_info mapping_info = { > >> + .pmd_flag = __PAGE_KERNEL_LARGE_EXEC, > >> +}; > > > >> +void initialize_identity_maps(void) > >> { > >> + /* Init mapping_info with run-time function/buffer pointers. */ > >> + mapping_info.alloc_pgt_page = alloc_pgt_page; > >> + mapping_info.context = &pgt_data; > > > > Could you please outline the precise failure mode? What gets executed when, which > > pointer gets relocated and which not, and exactly when does it pose a problem, > > etc. > > It's the issue described at the top of misc.c: > > /* > * WARNING!! > * This code is compiled with -fPIC and it is relocated dynamically at > * run time, but no relocation processing is performed. This means that > * it is not safe to place pointers in static structures. > */ Btw., is there any way to detect such invalid pointers during build-time somehow? This is not the first such bug and I suspect it won't be the last one either. Thanks, Ingo