Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1395675
| From | tip-bot for Yinghai Lu <tipbot@zytor.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [tip:x86/boot] x86/KASLR: Consolidate mem_avoid[] entries |
| Date | 2016-05-06 09:50 +0200 |
| Message-ID | <rvIGm-ZB-9@gated-at.bofh.it> (permalink) |
| References | <rvzML-gY-21@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Commit-ID: 9dc1969c24eff8b7d7a9a565d1047b624921ba06
Gitweb: http://git.kernel.org/tip/9dc1969c24eff8b7d7a9a565d1047b624921ba06
Author: Yinghai Lu <yinghai@kernel.org>
AuthorDate: Thu, 5 May 2016 15:13:47 -0700
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Fri, 6 May 2016 09:00:59 +0200
x86/KASLR: Consolidate mem_avoid[] entries
The mem_avoid[] array is used to track positions that should be avoided (like
the compressed kernel, decompression code, etc) when selecting a memory
position for the randomly relocated kernel. Since ZO is now at the end of
the decompression buffer and the decompression code (and its heap and
stack) are at the front, we can safely consolidate the decompression entry,
the heap entry, and the stack entry. The boot_params memory, however, could
be elsewhere, so it should be explicitly included.
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Baoquan He <bhe@redhat.com>
[ Rwrote changelog, cleaned up code comments. ]
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: kernel-hardening@lists.openwall.com
Cc: lasse.collin@tukaani.org
Link: http://lkml.kernel.org/r/1462486436-3707-3-git-send-email-keescook@chromium.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
arch/x86/boot/compressed/kaslr.c | 77 +++++++++++++++++++++++++++++++---------
1 file changed, 61 insertions(+), 16 deletions(-)
diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
index 2072d82..6392f00 100644
--- a/arch/x86/boot/compressed/kaslr.c
+++ b/arch/x86/boot/compressed/kaslr.c
@@ -121,7 +121,7 @@ struct mem_vector {
unsigned long size;
};
-#define MEM_AVOID_MAX 5
+#define MEM_AVOID_MAX 4
static struct mem_vector mem_avoid[MEM_AVOID_MAX];
static bool mem_contains(struct mem_vector *region, struct mem_vector *item)
@@ -146,22 +146,71 @@ static bool mem_overlaps(struct mem_vector *one, struct mem_vector *two)
return true;
}
+/*
+ * In theroy, KASLR can put the kernel anywhere in area of [16M, 64T). The
+ * mem_avoid array is used to store the ranges that need to be avoided when
+ * KASLR searches for a an appropriate random address. We must avoid any
+ * regions that are unsafe to overlap with during decompression, and other
+ * things like the initrd, cmdline and boot_params.
+ *
+ * How to calculate the unsafe areas is detailed here, and is informed by
+ * the decompression calculations in header.S, and the diagram in misc.c.
+ *
+ * The compressed vmlinux (ZO) plus relocs and the run space of ZO can't be
+ * overwritten by decompression output.
+ *
+ * ZO sits against the end of the decompression buffer, so we can calculate
+ * where text, data, bss, etc of ZO are positioned.
+ *
+ * The follow are already enforced by the code:
+ * - init_size >= kernel_total_size
+ * - input + input_len >= output + output_len
+ * - kernel_total_size could be >= or < output_len
+ *
+ * From this, we can make several observations, illustrated by a diagram:
+ * - init_size >= kernel_total_size
+ * - input + input_len > output + output_len
+ * - kernel_total_size >= output_len
+ *
+ * 0 output input input+input_len output+init_size
+ * | | | | |
+ * | | | | |
+ * |-----|--------|--------|------------------|----|------------|----------|
+ * | | |
+ * | | |
+ * output+init_size-ZO_INIT_SIZE output+output_len output+kernel_total_size
+ *
+ * [output, output+init_size) is for the buffer for decompressing the
+ * compressed kernel (ZO).
+ *
+ * [output, output+kernel_total_size) is for the uncompressed kernel (VO)
+ * and its bss, brk, etc.
+ * [output, output+output_len) is VO plus relocs
+ *
+ * [output+init_size-ZO_INIT_SIZE, output+init_size) is the copied ZO.
+ * [input, input+input_len) is the copied compressed (VO (vmlinux after
+ * objcopy) plus relocs), not the ZO.
+ *
+ * [input+input_len, output+init_size) is [_text, _end) for ZO. That was the
+ * first range in mem_avoid, which included ZO's heap and stack. Also
+ * [input, input+input_size) need be put in mem_avoid array, but since it
+ * is adjacent to the first entry, they can be merged. This is how we get
+ * the first entry in mem_avoid[].
+ */
static void mem_avoid_init(unsigned long input, unsigned long input_size,
- unsigned long output, unsigned long output_size)
+ unsigned long output)
{
+ unsigned long init_size = boot_params->hdr.init_size;
u64 initrd_start, initrd_size;
u64 cmd_line, cmd_line_size;
- unsigned long unsafe, unsafe_len;
char *ptr;
/*
* Avoid the region that is unsafe to overlap during
- * decompression (see calculations in ../header.S).
+ * decompression.
*/
- unsafe_len = (output_size >> 12) + 32768 + 18;
- unsafe = (unsigned long)input + input_size - unsafe_len;
- mem_avoid[0].start = unsafe;
- mem_avoid[0].size = unsafe_len;
+ mem_avoid[0].start = input;
+ mem_avoid[0].size = (output + init_size) - input;
/* Avoid initrd. */
initrd_start = (u64)boot_params->ext_ramdisk_image << 32;
@@ -181,13 +230,9 @@ static void mem_avoid_init(unsigned long input, unsigned long input_size,
mem_avoid[2].start = cmd_line;
mem_avoid[2].size = cmd_line_size;
- /* Avoid heap memory. */
- mem_avoid[3].start = (unsigned long)free_mem_ptr;
- mem_avoid[3].size = BOOT_HEAP_SIZE;
-
- /* Avoid stack memory. */
- mem_avoid[4].start = (unsigned long)free_mem_end_ptr;
- mem_avoid[4].size = BOOT_STACK_SIZE;
+ /* Avoid params */
+ mem_avoid[3].start = (unsigned long)boot_params;
+ mem_avoid[3].size = sizeof(*boot_params);
}
/* Does this memory vector overlap a known avoided area? */
@@ -337,7 +382,7 @@ unsigned char *choose_random_location(unsigned char *input_ptr,
boot_params->hdr.loadflags |= KASLR_FLAG;
/* Record the various known unsafe memory ranges. */
- mem_avoid_init(input, input_size, output, output_size);
+ mem_avoid_init(input, input_size, output);
/* Walk e820 and find a random address. */
random_addr = find_random_addr(output, output_size);
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH v6 0/11] x86/KASLR: Randomize virtual address separately Kees Cook <keescook@chromium.org> - 2016-05-06 00:20 +0200
[PATCH v6 04/11] x86/KASLR: Build identity mappings on demand Kees Cook <keescook@chromium.org> - 2016-05-06 00:20 +0200
Re: [PATCH v6 04/11] x86/KASLR: Build identity mappings on demand Ingo Molnar <mingo@kernel.org> - 2016-05-06 09:10 +0200
Re: [PATCH v6 04/11] x86/KASLR: Build identity mappings on demand Kees Cook <keescook@chromium.org> - 2016-05-06 19:50 +0200
[PATCH v6 05/11] x86/KASLR: Add slot_area to manage random_addr slots Kees Cook <keescook@chromium.org> - 2016-05-06 00:20 +0200
[PATCH v6 02/11] x86/KASLR: Consolidate mem_avoid entries Kees Cook <keescook@chromium.org> - 2016-05-06 00:20 +0200
[tip:x86/boot] x86/KASLR: Consolidate mem_avoid[] entries tip-bot for Yinghai Lu <tipbot@zytor.com> - 2016-05-06 09:50 +0200
Re: [tip:x86/boot] x86/KASLR: Consolidate mem_avoid[] entries Borislav Petkov <bp@alien8.de> - 2016-05-06 18:10 +0200
Re: [tip:x86/boot] x86/KASLR: Consolidate mem_avoid[] entries Kees Cook <keescook@chromium.org> - 2016-05-06 20:20 +0200
Re: [tip:x86/boot] x86/KASLR: Consolidate mem_avoid[] entries Borislav Petkov <bp@alien8.de> - 2016-05-06 21:40 +0200
[PATCH v6 10/11] x86/KASLR: Add physical address randomization >4G Kees Cook <keescook@chromium.org> - 2016-05-06 00:20 +0200
Re: [PATCH v6 10/11] x86/KASLR: Add physical address randomization >4G Baoquan He <bhe@redhat.com> - 2016-05-06 10:30 +0200
Re: [PATCH v6 10/11] x86/KASLR: Add physical address randomization >4G Kees Cook <keescook@chromium.org> - 2016-05-06 17:40 +0200
Re: [PATCH v6 10/11] x86/KASLR: Add physical address randomization >4G Baoquan He <bhe@redhat.com> - 2016-05-08 11:20 +0200
[PATCH v6 06/11] x86/KASLR: Return earliest overlap when avoiding regions Kees Cook <keescook@chromium.org> - 2016-05-06 00:20 +0200
[PATCH v6 01/11] x86/boot: Clean up pointer casting Kees Cook <keescook@chromium.org> - 2016-05-06 00:20 +0200
[tip:x86/boot] x86/boot: Clean up pointer casting tip-bot for Kees Cook <tipbot@zytor.com> - 2016-05-06 09:50 +0200
Re: [tip:x86/boot] x86/boot: Clean up pointer casting Borislav Petkov <bp@alien8.de> - 2016-05-06 11:00 +0200
Re: [tip:x86/boot] x86/boot: Clean up pointer casting Ingo Molnar <mingo@kernel.org> - 2016-05-06 12:20 +0200
Re: [tip:x86/boot] x86/boot: Clean up pointer casting Kees Cook <keescook@chromium.org> - 2016-05-06 17:30 +0200
Re: [tip:x86/boot] x86/boot: Clean up pointer casting Ingo Molnar <mingo@kernel.org> - 2016-05-06 12:40 +0200
Re: [tip:x86/boot] x86/boot: Clean up pointer casting Borislav Petkov <bp@alien8.de> - 2016-05-06 12:50 +0200
[PATCH -v1.1] x86/boot: Simplify pointer casting in choose_random_location() Borislav Petkov <bp@alien8.de> - 2016-05-06 14:00 +0200
[tip:x86/boot] x86/boot: Simplify pointer casting in choose_random_location() tip-bot for Borislav Petkov <tipbot@zytor.com> - 2016-05-07 08:40 +0200
csiph-web