[PATCH v2 1/2] x86/boot/KASLR: Add checking for the offset of kernel virtual address randomization

Path	csiph.com!news.mixmin.net!news.unit0.net!news.panservice.it!bofh.it!news.nic.it!robomod
From	Baoquan He <bhe@redhat.com>
Newsgroups	linux.kernel
Subject	[PATCH v2 1/2] x86/boot/KASLR: Add checking for the offset of kernel virtual address randomization
Date	Tue, 27 Jun 2017 14:40:01 +0200
Message-ID	<tWXWF-tx-13@gated-at.bofh.it> (permalink)
References	<tWXWF-tx-1@gated-at.bofh.it>
X-Original-To	mingo@kernel.org, linux-kernel@vger.kernel.org
Dmarc-Filter	OpenDMARC Filter v1.3.2 mx1.redhat.com 2C1DD68AD
Authentication-Results	ext-mx10.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com
Authentication-Results	ext-mx10.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=bhe@redhat.com
Dkim-Filter	OpenDKIM Filter v2.11.0 mx1.redhat.com 2C1DD68AD
X-Scanned-By	MIMEDefang 2.79 on 10.5.11.13
X-Greylist	Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Tue, 27 Jun 2017 12:39:15 +0000 (UTC)
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	32
Organization	linux.* mail to news gateway
X-Original-Cc	tglx@linutronix.de, hpa@zytor.com, Baoquan He <bhe@redhat.com>
X-Original-Date	Tue, 27 Jun 2017 20:39:05 +0800
X-Original-Message-ID	<1498567146-11990-2-git-send-email-bhe@redhat.com>
X-Original-References	<1498567146-11990-1-git-send-email-bhe@redhat.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1675626

Show key headers only | View raw

For kernel text KASLR, the virtual address is confined to area of 1G,
[0xffffffff80000000, 0xffffffffc0000000). For the implemenataion of
virtual address randomization, we only randomize to get an offset
between 16M and 1G, then add this offset to the starting address,
0xffffffff80000000. Here 16M is the offset which is decided at linking
stage. So the amount of the local variable 'virt_addr' which respresents
the offset plus the kernel output size can not exceed KERNEL_IMAGE_SIZE.

Add a judgement to check the offset. If out of bounds, print error
message and hang there.

Suggested-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Baoquan He <bhe@redhat.com>
---
 arch/x86/boot/compressed/misc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index b3c5a5f030ce..6008fa9b74d9 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -390,6 +390,8 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap,
 #ifdef CONFIG_X86_64
 	if (heap > 0x3fffffffffffUL)
 		error("Destination address too large");
+	if (virt_addr + max(output_len, kernel_total_size) > KERNEL_IMAGE_SIZE)
+		error("Destination virtual address is beyond the kernel mapping area");
 #else
 	if (heap > ((-__PAGE_OFFSET-(128<<20)-1) & 0x7fffffff))
 		error("Destination address too large");
-- 
2.5.5

Thread

[PATCH v2 0/2] x86/boot/KASLR: Code bug fix about kernel virtual address randomization Baoquan He <bhe@redhat.com> - 2017-06-27 14:40 +0200
  [PATCH v2 1/2] x86/boot/KASLR: Add checking for the offset of kernel virtual address randomization Baoquan He <bhe@redhat.com> - 2017-06-27 14:40 +0200
    [tip:x86/urgent] x86/boot/KASLR: Add checking for the offset of  kernel virtual address randomization tip-bot for Baoquan He <tipbot@zytor.com> - 2017-06-30 15:20 +0200
  [PATCH v2 2/2] x86/boot/KASLR: Fix the wrong assignment to 'virt_addr' Baoquan He <bhe@redhat.com> - 2017-06-27 14:40 +0200
    [tip:x86/urgent] x86/boot/KASLR: Fix kexec crash due to 'virt_addr'  calculation bug tip-bot for Baoquan He <tipbot@zytor.com> - 2017-06-30 15:20 +0200
  Re: [PATCH v2 0/2] x86/boot/KASLR: Code bug fix about kernel virtual  address randomization Dave Young <dyoung@redhat.com> - 2017-06-30 08:20 +0200

csiph-web