Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1620305

[PATCH 4.4 25/32] s390/decompressor: fix initrd corruption caused by bss clear

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>

commit d82c0d12c92705ef468683c9b7a8298dd61ed191 upstream.

Reorder the operations in decompress_kernel() to ensure initrd is moved
to a safe location before the bss section is zeroed.

During decompression bss can overlap with the initrd and this can
corrupt the initrd contents depending on the size of the compressed
kernel (which affects where the initrd is placed by the bootloader) and
the size of the bss section of the decompressor.

Also use the correct initrd size when checking for overlaps with
parmblock.

Fixes: 06c0dd72aea3 ([S390] fix boot failures with compressed kernels)
Reviewed-by: Joy Latten <joy.latten@canonical.com>
Reviewed-by: Vineetha HariPai <vineetha.hari.pai@canonical.com>
Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/boot/compressed/misc.c |   35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

--- a/arch/s390/boot/compressed/misc.c
+++ b/arch/s390/boot/compressed/misc.c
@@ -141,31 +141,34 @@ static void check_ipl_parmblock(void *st
 
 unsigned long decompress_kernel(void)
 {
-	unsigned long output_addr;
-	unsigned char *output;
+	void *output, *kernel_end;
 
-	output_addr = ((unsigned long) &_end + HEAP_SIZE + 4095UL) & -4096UL;
-	check_ipl_parmblock((void *) 0, output_addr + SZ__bss_start);
-	memset(&_bss, 0, &_ebss - &_bss);
-	free_mem_ptr = (unsigned long)&_end;
-	free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
-	output = (unsigned char *) output_addr;
+	output = (void *) ALIGN((unsigned long) &_end + HEAP_SIZE, PAGE_SIZE);
+	kernel_end = output + SZ__bss_start;
+	check_ipl_parmblock((void *) 0, (unsigned long) kernel_end);
 
 #ifdef CONFIG_BLK_DEV_INITRD
 	/*
 	 * Move the initrd right behind the end of the decompressed
-	 * kernel image.
+	 * kernel image. This also prevents initrd corruption caused by
+	 * bss clearing since kernel_end will always be located behind the
+	 * current bss section..
 	 */
-	if (INITRD_START && INITRD_SIZE &&
-	    INITRD_START < (unsigned long) output + SZ__bss_start) {
-		check_ipl_parmblock(output + SZ__bss_start,
-				    INITRD_START + INITRD_SIZE);
-		memmove(output + SZ__bss_start,
-			(void *) INITRD_START, INITRD_SIZE);
-		INITRD_START = (unsigned long) output + SZ__bss_start;
+	if (INITRD_START && INITRD_SIZE && kernel_end > (void *) INITRD_START) {
+		check_ipl_parmblock(kernel_end, INITRD_SIZE);
+		memmove(kernel_end, (void *) INITRD_START, INITRD_SIZE);
+		INITRD_START = (unsigned long) kernel_end;
 	}
 #endif
 
+	/*
+	 * Clear bss section. free_mem_ptr and free_mem_end_ptr need to be
+	 * initialized afterwards since they reside in bss.
+	 */
+	memset(&_bss, 0, &_ebss - &_bss);
+	free_mem_ptr = (unsigned long) &_end;
+	free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
+
 	puts("Uncompressing Linux... ");
 	__decompress(input_data, input_len, NULL, NULL, output, 0, NULL, error);
 	puts("Ok, booting the kernel.\n");

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/32] 4.4.61-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:40 +0200
  [PATCH 4.4 05/32] drm/vmwgfx: Remove getparam error message Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:40 +0200
  [PATCH 4.4 01/32] drm/vmwgfx: Type-check lookups of fence objects Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:40 +0200
  [PATCH 4.4 06/32] drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:40 +0200
  [PATCH 4.4 28/32] MIPS: ralink: Fix typos in rt3883 pinctrl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 09/32] arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 16/32] metag/usercopy: Fix alignment error checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 30/32] MIPS: Lantiq: fix missing xbar kernel panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 32/32] mm/mempolicy.c: fix error handling in set_mempolicy and mbind. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 23/32] powerpc: Dont try to fix up misaligned load-with-reservation instructions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 20/32] metag/usercopy: Fix src fixup in from user rapf loops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 08/32] staging: android: ashmem: lseek failed due to no FMODE_LSEEK. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 29/32] MIPS: End spinlocks with .insn Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 27/32] MIPS: Force o32 fp64 support on 32bit MIPS64r6 kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
    Re: [PATCH 4.4 27/32] MIPS: Force o32 fp64 support on 32bit MIPS64r6  kernels "Maciej W. Rozycki" <macro@linux-mips.org> - 2017-04-15 01:50 +0200
      Re: [PATCH 4.4 27/32] MIPS: Force o32 fp64 support on 32bit MIPS64r6  kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 15:20 +0200
  [PATCH 4.4 26/32] s390/uaccess: get_user() should zero on failure (again) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 31/32] MIPS: Flush wrong invalid FTLB entry for huge page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 14/32] ring-buffer: Fix return value check in test_ringbuffer() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 17/32] metag/usercopy: Add early abort to copy_to_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 22/32] powerpc/mm: Add missing global TLB invalidate if cxl is active Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 04/32] drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 25/32] s390/decompressor: fix initrd corruption caused by bss clear Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 15/32] metag/usercopy: Drop unused macros Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 24/32] nios2: reserve boot memory for device tree Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
  [PATCH 4.4 21/32] metag/usercopy: Add missing fixups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 11/32] iio: bmg160: reset chip when probing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 19/32] metag/usercopy: Set flags before ADDZ Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 13/32] ptrace: fix PTRACE_LISTEN race corrupting task->state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 18/32] metag/usercopy: Zero rest of buffer from copy_from_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 10/32] arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 12/32] Reset TreeId to zero on SMB2 TREE_CONNECT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 02/32] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  [PATCH 4.4 07/32] sysfs: be careful of error returns from ops->show() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
  Re: [PATCH 4.4 00/32] 4.4.61-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-10 22:40 +0200

csiph-web