Re: [PATCH v3 07/19] x86, kaslr: Get correct max_addr for relocs pointer

[Baoquan He <bhe@redhat.com>]

On 03/08/16 at 10:16am, Kees Cook wrote:
> On Mon, Mar 7, 2016 at 9:13 PM, Baoquan He <bhe@redhat.com> wrote:
> > On 03/07/16 at 03:16pm, Kees Cook wrote:
> >> On Fri, Mar 4, 2016 at 8:25 AM, Baoquan He <bhe@redhat.com> wrote:
> >> > From: Yinghai Lu <yinghai@kernel.org>
> >> >
> >> > There is boundary checking for pointer in kaslr relocation handling.
> >> >
> >> > Current code is using output_len, and that is VO (vmlinux after objcopy)
> >> > file size plus vmlinux.relocs file size.
> >> >
> >> > That is not right, as we should use loaded address for running.
> >>
> >> I think this needs clarification. If I'm understanding correctly, the
> >> max_addr check should stop at the end of VO, and not include bss, brk,
> >> etc. which follows. In which case, this change is correct: the bounds
> >> checking needed to be tightened.
> >
> > Yes, exactly as you means.
> >
> >>
> >>
> >> >
> >> > At that time parse_elf already move the sections according to ELF headers.
> >> >
> >> > The valid range should be VO [_text, __bss_start) loaded physical addresses.
> >
> > I think it is expressed here. Maybe we can stress it in this patch log.
> > After all it's the main idea of this patch.
> >
> > How about rewriting patch log like this:
> >
> > ********************
> > There is boundary checking for pointer in kaslr relocation handling.
> > However current code is using output_len that is VO (vmlinux after objcopy)
> > file size plus vmlinux.relocs file size to make the valid boundary.
> >
> > That is not right since the max_addr check should stop at the end of VO
> > and excludes bss, brk etc, which follows. Means the valid range should
> > be VO [_text, __bss_start] in loaded physical address space.
> >
> > In this patch, add export for __bss_start to voffset.h and use it to get
> > max_addr.
> > ********************
> 
> I would say:
> 
> Relocation handling performs bounds checking on the relocated
> addresses. The existing code uses output_len (VO size plus relocs
> size) as the max address. This is not right since the max_addr check
> should stop at the end of VO and exclude bss, brk, etc, which follows.
> The valid range should be VO [_text, __bss_start] in the loaded
> physical address space.
> 
> In this patch, add export for __bss_start to voffset.h and use it to
> get the correct max_addr.

Yeah, it's much better. Will use this as patch log.

Thanks!

> 
> 
> Thanks!
> 
> -Kees
> 
> >
> >> >
> >> > In the patch, add export for __bss_start to voffset.h and use it to get
> >> > max_addr.
> >> >
> >> > Signed-off-by: Yinghai Lu <yinghai@kernel.org>
> >> > ---
> >> > v2->v3:
> >> >     Tune the patch log.
> >> >
> >> >  arch/x86/boot/compressed/Makefile | 2 +-
> >> >  arch/x86/boot/compressed/misc.c   | 2 +-
> >> >  2 files changed, 2 insertions(+), 2 deletions(-)
> >> >
> >> > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
> >> > index fef80fa..2e7c0ce 100644
> >> > --- a/arch/x86/boot/compressed/Makefile
> >> > +++ b/arch/x86/boot/compressed/Makefile
> >> > @@ -41,7 +41,7 @@ LDFLAGS_vmlinux := -T
> >> >  hostprogs-y    := mkpiggy
> >> >  HOST_EXTRACFLAGS += -I$(srctree)/tools/include
> >> >
> >> > -sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p'
> >> > +sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p'
> >> >
> >> >  quiet_cmd_voffset = VOFFSET $@
> >> >        cmd_voffset = $(NM) $< | sed -n $(sed-voffset) > $@
> >> > diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
> >> > index 069120e..dd7ed8a 100644
> >> > --- a/arch/x86/boot/compressed/misc.c
> >> > +++ b/arch/x86/boot/compressed/misc.c
> >> > @@ -259,7 +259,7 @@ static void handle_relocations(void *output, unsigned long output_len)
> >> >         int *reloc;
> >> >         unsigned long delta, map, ptr;
> >> >         unsigned long min_addr = (unsigned long)output;
> >> > -       unsigned long max_addr = min_addr + output_len;
> >> > +       unsigned long max_addr = min_addr + (VO___bss_start - VO__text);
> >> >
> >> >         /*
> >> >          * Calculate the delta between where vmlinux was linked to load
> >> > --
> >> > 2.5.0
> >> >
> >>
> >>
> >>
> >> --
> >> Kees Cook
> >> Chrome OS & Brillo Security
> 
> 
> 
> -- 
> Kees Cook
> Chrome OS & Brillo Security