From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933353AbdD0HSu (ORCPT ); Thu, 27 Apr 2017 03:18:50 -0400 Received: from mx1.redhat.com ([209.132.183.28]:55854 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932589AbdD0HSm (ORCPT ); Thu, 27 Apr 2017 03:18:42 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 7C2C880F9D Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=bhe@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 7C2C880F9D Date: Thu, 27 Apr 2017 15:18:33 +0800 From: Baoquan He To: Kees Cook Cc: LKML , Ingo Molnar , Thomas Garnier , Dave Young , Xunlei Pang , "H. Peter Anvin" , Thomas Gleixner , "x86@kernel.org" , Yinghai Lu , Borislav Petkov , Dave Jiang Subject: Re: [PATCH 2/2] x86/KASLR: Use old ident map page table if physical randomization failed Message-ID: <20170427071833.GJ2794@x1> References: <1493203160-20148-1-git-send-email-bhe@redhat.com> <1493203160-20148-3-git-send-email-bhe@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.7.0 (2016-08-17) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Thu, 27 Apr 2017 07:18:41 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 04/26/17 at 12:12pm, Kees Cook wrote: > On Wed, Apr 26, 2017 at 3:39 AM, Baoquan He wrote: > > Dave found when kdump kernel will reset to bios immediately if kaslr > > is enabled and physical randomization failed to faind a new position > > for kernel. But nokaslr works in this case. > > > > The reason is kaslr will install a new page table for ident mapping, > > while it missed to consider building ident mapping for original area > > of kernel if kaslr failed on physical randomization. > > > > In fact bootloaders including kexec/kdump have built ident mapping > > for original place of kernel. We can only install new ident mapping > > page table when physical kaslr succeeds. Otherwise we just keep the > > old page table unchanged just like nokaslr does. > > > > Signed-off-by: Baoquan He > > Signed-off-by: Dave Young > > Cc: "H. Peter Anvin" > > Cc: Thomas Gleixner > > Cc: Ingo Molnar > > Cc: x86@kernel.org > > Cc: Kees Cook > > Cc: Yinghai Lu > > Cc: Borislav Petkov > > Cc: Dave Jiang > > Cc: Thomas Garnier > > Nice catch! > > Acked-by: Kees Cook Thanks, Kees. Seems I forget telling this only happens in kexec/kdump kernel. Since the ident mapping has been built for kexec/kdump in 1st kernel for the whole memory by calling init_pgtable(). Here if physical randomizaiton failed, it won't build ident mapping for the original area of kernel but change to new page table '_pgtable'. Then kernel will reset to bios immediately caused by no ident mapping. While normal kernel won't be impacted because it comes here via startup_32() and cr3 will be _pgtable already. In startup_32() ident mapping is built for 0~4G area. In kaslr We just append to the existing area instead of entirely overwriting it for on-demand ident mapping building. So ident mapping for the original area of kernel is still there. I will post v2 with a improved patch log, and with your Acked-by. > > -Kees > > > --- > > arch/x86/boot/compressed/kaslr.c | 10 ++++++++-- > > 1 file changed, 8 insertions(+), 2 deletions(-) > > > > diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c > > index e5eb0c3..7a8b443 100644 > > --- a/arch/x86/boot/compressed/kaslr.c > > +++ b/arch/x86/boot/compressed/kaslr.c > > @@ -650,10 +650,16 @@ void choose_random_location(unsigned long input, > > add_identity_map(random_addr, output_size); > > *output = random_addr; > > } > > + > > + /* > > + * This actually loads the identity pagetable on x86_64. > > + * And this should only be done only if a new position > > + * is found. Otherwise we should keep the old page table > > + * to make it be like nokaslr case. > > + */ > > + finalize_identity_maps(); > > } > > > > - /* This actually loads the identity pagetable on x86_64. */ > > - finalize_identity_maps(); > > > > /* Pick random virtual address starting from LOAD_PHYSICAL_ADDR. */ > > if (IS_ENABLED(CONFIG_X86_64)) > > -- > > 2.5.5 > > > > > > -- > Kees Cook > Pixel Security