From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752191AbdF0I47 (ORCPT ); Tue, 27 Jun 2017 04:56:59 -0400 Received: from mx1.redhat.com ([209.132.183.28]:48432 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751536AbdF0Iz0 (ORCPT ); Tue, 27 Jun 2017 04:55:26 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 9E75E7D0E9 Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx02.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=bhe@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 9E75E7D0E9 Date: Tue, 27 Jun 2017 16:55:22 +0800 From: Baoquan He To: Ingo Molnar Cc: linux-kernel@vger.kernel.org, Thomas Gleixner , "H. Peter Anvin" Subject: Re: [PATCH] x86/boot/KASLR: Skip relocation handling in no kaslr case Message-ID: <20170627085522.GB26238@x1> References: <1498314309-18502-1-git-send-email-bhe@redhat.com> <20170626094737.d2pzetkhe2sorn6m@gmail.com> <20170626104349.GA3303@x1> <20170627083458.6xn3udgympkb2y3n@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170627083458.6xn3udgympkb2y3n@gmail.com> User-Agent: Mutt/1.7.0 (2016-08-17) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Tue, 27 Jun 2017 08:55:25 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 06/27/17 at 10:34am, Ingo Molnar wrote: > > * Baoquan He wrote: > > > As you suggested, we can add a checking to see if the virt_addr is > > bigger than 1G, and print warning if exceed or hang there with error > > message. > > Could you try a patch for that, and see whether it catches this particular bug? > (before the fix is applied.) Sure, below code change should catch it. Just I am struggling to decide if I should add a new local variable and assign max(output_len, kernel_total_size) to it, and the name of the new local variable is really hard to choose. Let me run a test on below code. diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c index c945acd8fa33..00241c815524 100644 --- a/arch/x86/boot/compressed/misc.c +++ b/arch/x86/boot/compressed/misc.c @@ -390,6 +390,8 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap, #ifdef CONFIG_X86_64 if (heap > 0x3fffffffffffUL) error("Destination address too large"); + if (virt_addr + max(output_len, kernel_total_size) > KERNEL_IMAGE_SIZE) + error("Destination virtual address is beyond the kernel mapping area"); #else if (heap > ((-__PAGE_OFFSET-(128<<20)-1) & 0x7fffffff)) error("Destination address too large");