Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1350426 > unrolled thread
| Started by | Baoquan He <bhe@redhat.com> |
|---|---|
| First post | 2016-03-04 17:30 +0100 |
| Last post | 2016-03-09 14:50 +0100 |
| Articles | 5 — 2 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
[PATCH v3 07/19] x86, kaslr: Get correct max_addr for relocs pointer Baoquan He <bhe@redhat.com> - 2016-03-04 17:30 +0100
Re: [PATCH v3 07/19] x86, kaslr: Get correct max_addr for relocs pointer Kees Cook <keescook@chromium.org> - 2016-03-08 00:20 +0100
Re: [PATCH v3 07/19] x86, kaslr: Get correct max_addr for relocs pointer Baoquan He <bhe@redhat.com> - 2016-03-08 06:20 +0100
Re: [PATCH v3 07/19] x86, kaslr: Get correct max_addr for relocs pointer Kees Cook <keescook@chromium.org> - 2016-03-08 19:20 +0100
Re: [PATCH v3 07/19] x86, kaslr: Get correct max_addr for relocs pointer Baoquan He <bhe@redhat.com> - 2016-03-09 14:50 +0100
| From | Baoquan He <bhe@redhat.com> |
|---|---|
| Date | 2016-03-04 17:30 +0100 |
| Subject | [PATCH v3 07/19] x86, kaslr: Get correct max_addr for relocs pointer |
| Message-ID | <r90M3-Y1-55@gated-at.bofh.it> |
From: Yinghai Lu <yinghai@kernel.org>
There is boundary checking for pointer in kaslr relocation handling.
Current code is using output_len, and that is VO (vmlinux after objcopy)
file size plus vmlinux.relocs file size.
That is not right, as we should use loaded address for running.
At that time parse_elf already move the sections according to ELF headers.
The valid range should be VO [_text, __bss_start) loaded physical addresses.
In the patch, add export for __bss_start to voffset.h and use it to get
max_addr.
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
---
v2->v3:
Tune the patch log.
arch/x86/boot/compressed/Makefile | 2 +-
arch/x86/boot/compressed/misc.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index fef80fa..2e7c0ce 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -41,7 +41,7 @@ LDFLAGS_vmlinux := -T
hostprogs-y := mkpiggy
HOST_EXTRACFLAGS += -I$(srctree)/tools/include
-sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p'
+sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p'
quiet_cmd_voffset = VOFFSET $@
cmd_voffset = $(NM) $< | sed -n $(sed-voffset) > $@
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 069120e..dd7ed8a 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -259,7 +259,7 @@ static void handle_relocations(void *output, unsigned long output_len)
int *reloc;
unsigned long delta, map, ptr;
unsigned long min_addr = (unsigned long)output;
- unsigned long max_addr = min_addr + output_len;
+ unsigned long max_addr = min_addr + (VO___bss_start - VO__text);
/*
* Calculate the delta between where vmlinux was linked to load
--
2.5.0
[toc] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2016-03-08 00:20 +0100 |
| Message-ID | <racBs-YH-23@gated-at.bofh.it> |
| In reply to | #1350426 |
On Fri, Mar 4, 2016 at 8:25 AM, Baoquan He <bhe@redhat.com> wrote: > From: Yinghai Lu <yinghai@kernel.org> > > There is boundary checking for pointer in kaslr relocation handling. > > Current code is using output_len, and that is VO (vmlinux after objcopy) > file size plus vmlinux.relocs file size. > > That is not right, as we should use loaded address for running. I think this needs clarification. If I'm understanding correctly, the max_addr check should stop at the end of VO, and not include bss, brk, etc. which follows. In which case, this change is correct: the bounds checking needed to be tightened. -Kees > > At that time parse_elf already move the sections according to ELF headers. > > The valid range should be VO [_text, __bss_start) loaded physical addresses. > > In the patch, add export for __bss_start to voffset.h and use it to get > max_addr. > > Signed-off-by: Yinghai Lu <yinghai@kernel.org> > --- > v2->v3: > Tune the patch log. > > arch/x86/boot/compressed/Makefile | 2 +- > arch/x86/boot/compressed/misc.c | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile > index fef80fa..2e7c0ce 100644 > --- a/arch/x86/boot/compressed/Makefile > +++ b/arch/x86/boot/compressed/Makefile > @@ -41,7 +41,7 @@ LDFLAGS_vmlinux := -T > hostprogs-y := mkpiggy > HOST_EXTRACFLAGS += -I$(srctree)/tools/include > > -sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' > +sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' > > quiet_cmd_voffset = VOFFSET $@ > cmd_voffset = $(NM) $< | sed -n $(sed-voffset) > $@ > diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c > index 069120e..dd7ed8a 100644 > --- a/arch/x86/boot/compressed/misc.c > +++ b/arch/x86/boot/compressed/misc.c > @@ -259,7 +259,7 @@ static void handle_relocations(void *output, unsigned long output_len) > int *reloc; > unsigned long delta, map, ptr; > unsigned long min_addr = (unsigned long)output; > - unsigned long max_addr = min_addr + output_len; > + unsigned long max_addr = min_addr + (VO___bss_start - VO__text); > > /* > * Calculate the delta between where vmlinux was linked to load > -- > 2.5.0 > -- Kees Cook Chrome OS & Brillo Security
[toc] | [prev] | [next] | [standalone]
| From | Baoquan He <bhe@redhat.com> |
|---|---|
| Date | 2016-03-08 06:20 +0100 |
| Subject | Re: [PATCH v3 07/19] x86, kaslr: Get correct max_addr for relocs pointer |
| Message-ID | <raidQ-4Nk-5@gated-at.bofh.it> |
| In reply to | #1352126 |
On 03/07/16 at 03:16pm, Kees Cook wrote: > On Fri, Mar 4, 2016 at 8:25 AM, Baoquan He <bhe@redhat.com> wrote: > > From: Yinghai Lu <yinghai@kernel.org> > > > > There is boundary checking for pointer in kaslr relocation handling. > > > > Current code is using output_len, and that is VO (vmlinux after objcopy) > > file size plus vmlinux.relocs file size. > > > > That is not right, as we should use loaded address for running. > > I think this needs clarification. If I'm understanding correctly, the > max_addr check should stop at the end of VO, and not include bss, brk, > etc. which follows. In which case, this change is correct: the bounds > checking needed to be tightened. Yes, exactly as you means. > > > > > > At that time parse_elf already move the sections according to ELF headers. > > > > The valid range should be VO [_text, __bss_start) loaded physical addresses. I think it is expressed here. Maybe we can stress it in this patch log. After all it's the main idea of this patch. How about rewriting patch log like this: ******************** There is boundary checking for pointer in kaslr relocation handling. However current code is using output_len that is VO (vmlinux after objcopy) file size plus vmlinux.relocs file size to make the valid boundary. That is not right since the max_addr check should stop at the end of VO and excludes bss, brk etc, which follows. Means the valid range should be VO [_text, __bss_start] in loaded physical address space. In this patch, add export for __bss_start to voffset.h and use it to get max_addr. ******************** > > > > In the patch, add export for __bss_start to voffset.h and use it to get > > max_addr. > > > > Signed-off-by: Yinghai Lu <yinghai@kernel.org> > > --- > > v2->v3: > > Tune the patch log. > > > > arch/x86/boot/compressed/Makefile | 2 +- > > arch/x86/boot/compressed/misc.c | 2 +- > > 2 files changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile > > index fef80fa..2e7c0ce 100644 > > --- a/arch/x86/boot/compressed/Makefile > > +++ b/arch/x86/boot/compressed/Makefile > > @@ -41,7 +41,7 @@ LDFLAGS_vmlinux := -T > > hostprogs-y := mkpiggy > > HOST_EXTRACFLAGS += -I$(srctree)/tools/include > > > > -sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' > > +sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' > > > > quiet_cmd_voffset = VOFFSET $@ > > cmd_voffset = $(NM) $< | sed -n $(sed-voffset) > $@ > > diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c > > index 069120e..dd7ed8a 100644 > > --- a/arch/x86/boot/compressed/misc.c > > +++ b/arch/x86/boot/compressed/misc.c > > @@ -259,7 +259,7 @@ static void handle_relocations(void *output, unsigned long output_len) > > int *reloc; > > unsigned long delta, map, ptr; > > unsigned long min_addr = (unsigned long)output; > > - unsigned long max_addr = min_addr + output_len; > > + unsigned long max_addr = min_addr + (VO___bss_start - VO__text); > > > > /* > > * Calculate the delta between where vmlinux was linked to load > > -- > > 2.5.0 > > > > > > -- > Kees Cook > Chrome OS & Brillo Security
[toc] | [prev] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2016-03-08 19:20 +0100 |
| Message-ID | <rauoF-4zc-1@gated-at.bofh.it> |
| In reply to | #1352636 |
On Mon, Mar 7, 2016 at 9:13 PM, Baoquan He <bhe@redhat.com> wrote: > On 03/07/16 at 03:16pm, Kees Cook wrote: >> On Fri, Mar 4, 2016 at 8:25 AM, Baoquan He <bhe@redhat.com> wrote: >> > From: Yinghai Lu <yinghai@kernel.org> >> > >> > There is boundary checking for pointer in kaslr relocation handling. >> > >> > Current code is using output_len, and that is VO (vmlinux after objcopy) >> > file size plus vmlinux.relocs file size. >> > >> > That is not right, as we should use loaded address for running. >> >> I think this needs clarification. If I'm understanding correctly, the >> max_addr check should stop at the end of VO, and not include bss, brk, >> etc. which follows. In which case, this change is correct: the bounds >> checking needed to be tightened. > > Yes, exactly as you means. > >> >> >> > >> > At that time parse_elf already move the sections according to ELF headers. >> > >> > The valid range should be VO [_text, __bss_start) loaded physical addresses. > > I think it is expressed here. Maybe we can stress it in this patch log. > After all it's the main idea of this patch. > > How about rewriting patch log like this: > > ******************** > There is boundary checking for pointer in kaslr relocation handling. > However current code is using output_len that is VO (vmlinux after objcopy) > file size plus vmlinux.relocs file size to make the valid boundary. > > That is not right since the max_addr check should stop at the end of VO > and excludes bss, brk etc, which follows. Means the valid range should > be VO [_text, __bss_start] in loaded physical address space. > > In this patch, add export for __bss_start to voffset.h and use it to get > max_addr. > ******************** I would say: Relocation handling performs bounds checking on the relocated addresses. The existing code uses output_len (VO size plus relocs size) as the max address. This is not right since the max_addr check should stop at the end of VO and exclude bss, brk, etc, which follows. The valid range should be VO [_text, __bss_start] in the loaded physical address space. In this patch, add export for __bss_start to voffset.h and use it to get the correct max_addr. Thanks! -Kees > >> > >> > In the patch, add export for __bss_start to voffset.h and use it to get >> > max_addr. >> > >> > Signed-off-by: Yinghai Lu <yinghai@kernel.org> >> > --- >> > v2->v3: >> > Tune the patch log. >> > >> > arch/x86/boot/compressed/Makefile | 2 +- >> > arch/x86/boot/compressed/misc.c | 2 +- >> > 2 files changed, 2 insertions(+), 2 deletions(-) >> > >> > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile >> > index fef80fa..2e7c0ce 100644 >> > --- a/arch/x86/boot/compressed/Makefile >> > +++ b/arch/x86/boot/compressed/Makefile >> > @@ -41,7 +41,7 @@ LDFLAGS_vmlinux := -T >> > hostprogs-y := mkpiggy >> > HOST_EXTRACFLAGS += -I$(srctree)/tools/include >> > >> > -sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' >> > +sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' >> > >> > quiet_cmd_voffset = VOFFSET $@ >> > cmd_voffset = $(NM) $< | sed -n $(sed-voffset) > $@ >> > diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c >> > index 069120e..dd7ed8a 100644 >> > --- a/arch/x86/boot/compressed/misc.c >> > +++ b/arch/x86/boot/compressed/misc.c >> > @@ -259,7 +259,7 @@ static void handle_relocations(void *output, unsigned long output_len) >> > int *reloc; >> > unsigned long delta, map, ptr; >> > unsigned long min_addr = (unsigned long)output; >> > - unsigned long max_addr = min_addr + output_len; >> > + unsigned long max_addr = min_addr + (VO___bss_start - VO__text); >> > >> > /* >> > * Calculate the delta between where vmlinux was linked to load >> > -- >> > 2.5.0 >> > >> >> >> >> -- >> Kees Cook >> Chrome OS & Brillo Security -- Kees Cook Chrome OS & Brillo Security
[toc] | [prev] | [next] | [standalone]
| From | Baoquan He <bhe@redhat.com> |
|---|---|
| Date | 2016-03-09 14:50 +0100 |
| Subject | Re: [PATCH v3 07/19] x86, kaslr: Get correct max_addr for relocs pointer |
| Message-ID | <raMEX-9f-27@gated-at.bofh.it> |
| In reply to | #1353285 |
On 03/08/16 at 10:16am, Kees Cook wrote: > On Mon, Mar 7, 2016 at 9:13 PM, Baoquan He <bhe@redhat.com> wrote: > > On 03/07/16 at 03:16pm, Kees Cook wrote: > >> On Fri, Mar 4, 2016 at 8:25 AM, Baoquan He <bhe@redhat.com> wrote: > >> > From: Yinghai Lu <yinghai@kernel.org> > >> > > >> > There is boundary checking for pointer in kaslr relocation handling. > >> > > >> > Current code is using output_len, and that is VO (vmlinux after objcopy) > >> > file size plus vmlinux.relocs file size. > >> > > >> > That is not right, as we should use loaded address for running. > >> > >> I think this needs clarification. If I'm understanding correctly, the > >> max_addr check should stop at the end of VO, and not include bss, brk, > >> etc. which follows. In which case, this change is correct: the bounds > >> checking needed to be tightened. > > > > Yes, exactly as you means. > > > >> > >> > >> > > >> > At that time parse_elf already move the sections according to ELF headers. > >> > > >> > The valid range should be VO [_text, __bss_start) loaded physical addresses. > > > > I think it is expressed here. Maybe we can stress it in this patch log. > > After all it's the main idea of this patch. > > > > How about rewriting patch log like this: > > > > ******************** > > There is boundary checking for pointer in kaslr relocation handling. > > However current code is using output_len that is VO (vmlinux after objcopy) > > file size plus vmlinux.relocs file size to make the valid boundary. > > > > That is not right since the max_addr check should stop at the end of VO > > and excludes bss, brk etc, which follows. Means the valid range should > > be VO [_text, __bss_start] in loaded physical address space. > > > > In this patch, add export for __bss_start to voffset.h and use it to get > > max_addr. > > ******************** > > I would say: > > Relocation handling performs bounds checking on the relocated > addresses. The existing code uses output_len (VO size plus relocs > size) as the max address. This is not right since the max_addr check > should stop at the end of VO and exclude bss, brk, etc, which follows. > The valid range should be VO [_text, __bss_start] in the loaded > physical address space. > > In this patch, add export for __bss_start to voffset.h and use it to > get the correct max_addr. Yeah, it's much better. Will use this as patch log. Thanks! > > > Thanks! > > -Kees > > > > >> > > >> > In the patch, add export for __bss_start to voffset.h and use it to get > >> > max_addr. > >> > > >> > Signed-off-by: Yinghai Lu <yinghai@kernel.org> > >> > --- > >> > v2->v3: > >> > Tune the patch log. > >> > > >> > arch/x86/boot/compressed/Makefile | 2 +- > >> > arch/x86/boot/compressed/misc.c | 2 +- > >> > 2 files changed, 2 insertions(+), 2 deletions(-) > >> > > >> > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile > >> > index fef80fa..2e7c0ce 100644 > >> > --- a/arch/x86/boot/compressed/Makefile > >> > +++ b/arch/x86/boot/compressed/Makefile > >> > @@ -41,7 +41,7 @@ LDFLAGS_vmlinux := -T > >> > hostprogs-y := mkpiggy > >> > HOST_EXTRACFLAGS += -I$(srctree)/tools/include > >> > > >> > -sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' > >> > +sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' > >> > > >> > quiet_cmd_voffset = VOFFSET $@ > >> > cmd_voffset = $(NM) $< | sed -n $(sed-voffset) > $@ > >> > diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c > >> > index 069120e..dd7ed8a 100644 > >> > --- a/arch/x86/boot/compressed/misc.c > >> > +++ b/arch/x86/boot/compressed/misc.c > >> > @@ -259,7 +259,7 @@ static void handle_relocations(void *output, unsigned long output_len) > >> > int *reloc; > >> > unsigned long delta, map, ptr; > >> > unsigned long min_addr = (unsigned long)output; > >> > - unsigned long max_addr = min_addr + output_len; > >> > + unsigned long max_addr = min_addr + (VO___bss_start - VO__text); > >> > > >> > /* > >> > * Calculate the delta between where vmlinux was linked to load > >> > -- > >> > 2.5.0 > >> > > >> > >> > >> > >> -- > >> Kees Cook > >> Chrome OS & Brillo Security > > > > -- > Kees Cook > Chrome OS & Brillo Security
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web