From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9065CC4167B for ; Fri, 30 Dec 2022 18:31:42 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pBK9x-0003TX-Aj; Fri, 30 Dec 2022 13:31:14 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pBK9v-0003Qd-8v for qemu-devel@nongnu.org; Fri, 30 Dec 2022 13:31:11 -0500 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pBK9t-0006Sm-F3 for qemu-devel@nongnu.org; Fri, 30 Dec 2022 13:31:11 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C658261B18; Fri, 30 Dec 2022 18:31:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 05574C433EF; Fri, 30 Dec 2022 18:31:04 +0000 (UTC) Authentication-Results: smtp.kernel.org; dkim=pass (1024-bit key) header.d=zx2c4.com header.i=@zx2c4.com header.b="J3B4XhDz" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zx2c4.com; s=20210105; t=1672425062; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=lXt2pVTyOEWOaU+OtHDx5id1pyeiBSa5KFgN5fm5To8=; b=J3B4XhDzHiZNH3A6G96GIpz/KipVLvZ1RxVHyk65whTC9NrpoVhIPmEqFC9bLj1QBihQKf 8AbhgrLypG41a+slb7Y5xXqqMLBLQ9o6eNyaZZ5YWl8TSEMIoEZGKJxvnQx6F6Cinw7v7F v9vMMBimh77q0o5DSPfiV4C2I9ADqF4= Received: by mail.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id 42803c24 (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO); Fri, 30 Dec 2022 18:31:02 +0000 (UTC) Date: Fri, 30 Dec 2022 19:30:58 +0100 From: "Jason A. Donenfeld" To: pbonzini@redhat.com, ebiggers@kernel.org, x86@kernel.org, linux-kernel@vger.kernel.org, qemu-devel@nongnu.org, ardb@kernel.org, kraxel@redhat.com, hpa@zytor.com, bp@alien8.de Subject: Re: [PATCH qemu] x86: don't let decompressed kernel image clobber setup_data Message-ID: References: <20221228143831.396245-1-Jason@zx2c4.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20221228143831.396245-1-Jason@zx2c4.com> Received-SPF: pass client-ip=2604:1380:4641:c500::1; envelope-from=SRS0=ek1s=44=zx2c4.com=Jason@kernel.org; helo=dfw.source.kernel.org X-Spam_score_int: -67 X-Spam_score: -6.8 X-Spam_bar: ------ X-Spam_report: (-6.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org On Wed, Dec 28, 2022 at 03:38:30PM +0100, Jason A. Donenfeld wrote: > The setup_data links are appended to the compressed kernel image. Since > the kernel image is typically loaded at 0x100000, setup_data lives at > `0x100000 + compressed_size`, which does not get relocated during the > kernel's boot process. > > The kernel typically decompresses the image starting at address > 0x1000000 (note: there's one more zero there than the decompressed image > above). This usually is fine for most kernels. > > However, if the compressed image is actually quite large, then > setup_data will live at a `0x100000 + compressed_size` that extends into > the decompressed zone at 0x1000000. In other words, if compressed_size > is larger than `0x1000000 - 0x100000`, then the decompression step will > clobber setup_data, resulting in crashes. > > Fix this by detecting that possibility, and if it occurs, put setup_data > *after* the end of the decompressed kernel, so that it doesn't get > clobbered. > > One caveat is that this only works for images less than around 64 > megabytes, so just bail out in that case. This is unfortunate, but I > don't currently have a way of fixing it. I've got a different solution now that tries to piggy back on cmdline. I'll send a v2. It avoids the 62MiB crash situation of this one and seems to work fine.