From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755411AbcFQIr6 (ORCPT ); Fri, 17 Jun 2016 04:47:58 -0400 Received: from mail-wm0-f68.google.com ([74.125.82.68]:33667 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753942AbcFQIrz (ORCPT ); Fri, 17 Jun 2016 04:47:55 -0400 Date: Fri, 17 Jun 2016 10:47:51 +0200 From: Ingo Molnar To: Kees Cook Cc: Yinghai Lu , Borislav Petkov , Baoquan He , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , "x86@kernel.org" , Andrew Morton , Josh Poimboeuf , Andrey Ryabinin , "H.J. Lu" , Dmitry Vyukov , LKML Subject: Re: [PATCH v9 5/5] x86/KASLR: Allow randomization below load address Message-ID: <20160617084751.GB4791@gmail.com> References: <1464216334-17200-1-git-send-email-keescook@chromium.org> <1464216334-17200-6-git-send-email-keescook@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1464216334-17200-6-git-send-email-keescook@chromium.org> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org * Kees Cook wrote: > From: Yinghai Lu > > Currently the physical randomization's lower boundary is the original > kernel load address. For bootloaders that load kernels into very high > memory (e.g. kexec), this means randomization takes place in a very small > window at the top of memory, ignoring the large region of physical memory > below the load address. > > Since mem_avoid is already correctly tracking the regions that must be > avoided, this patch changes the minimum address to whatever is less: > 512M (to conservatively avoid unknown things in lower memory) or the > load address. Now, for example, if the kernel is loaded at 8G, [512M, > 8G) will be added into possible physical memory positions. > > Signed-off-by: Yinghai Lu > [kees: rewrote changelog, refactor to use min()] > Signed-off-by: Kees Cook > --- > arch/x86/boot/compressed/kaslr.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c > index d0a823df183b..304c5c369aff 100644 > --- a/arch/x86/boot/compressed/kaslr.c > +++ b/arch/x86/boot/compressed/kaslr.c > @@ -492,7 +492,7 @@ void choose_random_location(unsigned long input, > unsigned long output_size, > unsigned long *virt_addr) > { > - unsigned long random_addr; > + unsigned long random_addr, min_addr; > > /* By default, keep output position unchanged. */ > *virt_addr = *output; > @@ -517,8 +517,11 @@ void choose_random_location(unsigned long input, > /* Record the various known unsafe memory ranges. */ > mem_avoid_init(input, input_size, *output); > > + /* Low end should be the smaller of 512M or initial location. */ > + min_addr = min(*output, 512UL << 20); > + > /* Walk e820 and find a random address. */ > - random_addr = find_random_phys_addr(*output, output_size); > + random_addr = find_random_phys_addr(min_addr, output_size); > if (!random_addr) { > warn("KASLR disabled: could not find suitable E820 region!"); > } else { There's no explanation in the code or in the changelog of why 512M was picked as the lower limit. Thanks, Ingo