Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1675626

[PATCH v2 1/2] x86/boot/KASLR: Add checking for the offset of kernel virtual address randomization

Show all headers | View raw

For kernel text KASLR, the virtual address is confined to area of 1G,
[0xffffffff80000000, 0xffffffffc0000000). For the implemenataion of
virtual address randomization, we only randomize to get an offset
between 16M and 1G, then add this offset to the starting address,
0xffffffff80000000. Here 16M is the offset which is decided at linking
stage. So the amount of the local variable 'virt_addr' which respresents
the offset plus the kernel output size can not exceed KERNEL_IMAGE_SIZE.

Add a judgement to check the offset. If out of bounds, print error
message and hang there.

Suggested-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Baoquan He <bhe@redhat.com>
---
 arch/x86/boot/compressed/misc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index b3c5a5f030ce..6008fa9b74d9 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -390,6 +390,8 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap,
 #ifdef CONFIG_X86_64
 	if (heap > 0x3fffffffffffUL)
 		error("Destination address too large");
+	if (virt_addr + max(output_len, kernel_total_size) > KERNEL_IMAGE_SIZE)
+		error("Destination virtual address is beyond the kernel mapping area");
 #else
 	if (heap > ((-__PAGE_OFFSET-(128<<20)-1) & 0x7fffffff))
 		error("Destination address too large");
-- 
2.5.5

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v2 0/2] x86/boot/KASLR: Code bug fix about kernel virtual address randomization Baoquan He <bhe@redhat.com> - 2017-06-27 14:40 +0200
  [PATCH v2 1/2] x86/boot/KASLR: Add checking for the offset of kernel virtual address randomization Baoquan He <bhe@redhat.com> - 2017-06-27 14:40 +0200
    [tip:x86/urgent] x86/boot/KASLR: Add checking for the offset of  kernel virtual address randomization tip-bot for Baoquan He <tipbot@zytor.com> - 2017-06-30 15:20 +0200
  [PATCH v2 2/2] x86/boot/KASLR: Fix the wrong assignment to 'virt_addr' Baoquan He <bhe@redhat.com> - 2017-06-27 14:40 +0200
    [tip:x86/urgent] x86/boot/KASLR: Fix kexec crash due to 'virt_addr'  calculation bug tip-bot for Baoquan He <tipbot@zytor.com> - 2017-06-30 15:20 +0200
  Re: [PATCH v2 0/2] x86/boot/KASLR: Code bug fix about kernel virtual  address randomization Dave Young <dyoung@redhat.com> - 2017-06-30 08:20 +0200

csiph-web