Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1631366 > unrolled thread

[PATCH 0/2] kaslr related bug fix

Back to article view | Back to linux.kernel

Contents

  [PATCH 0/2] kaslr related bug fix Baoquan He <bhe@redhat.com> - 2017-04-26 12:40 +0200
    [PATCH 2/2] x86/KASLR: Use old ident map page table if physical randomization failed Baoquan He <bhe@redhat.com> - 2017-04-26 12:50 +0200
      Re: [PATCH 2/2] x86/KASLR: Use old ident map page table if physical  randomization failed Baoquan He <bhe@redhat.com> - 2017-04-26 13:00 +0200
      Re: [PATCH 2/2] x86/KASLR: Use old ident map page table if physical  randomization failed Kees Cook <keescook@chromium.org> - 2017-04-26 21:20 +0200
        Re: [PATCH 2/2] x86/KASLR: Use old ident map page table if physical  randomization failed Baoquan He <bhe@redhat.com> - 2017-04-27 09:20 +0200

#1631366 — [PATCH 0/2] kaslr related bug fix

And the patch 2/2 is an urgent fix, should be sent to stable tree.
Patch 1/2 can be worked around by adding 'nokaslr' to kdump kernel
cmdline.

Baoquan He (2):
  x86/efi: Correct ident mapping of efi old_map when kalsr enabled
  x86/KASLR: Use old ident map page table if physical randomization
    failed

 arch/x86/boot/compressed/kaslr.c | 10 ++++++++--
 arch/x86/platform/efi/efi_64.c   | 35 +++++++++++++++++++++++++++--------
 2 files changed, 35 insertions(+), 10 deletions(-)

-- 
2.5.5

[toc] | [next] | [standalone]

#1631372 — [PATCH 2/2] x86/KASLR: Use old ident map page table if physical randomization failed

Dave found when kdump kernel will reset to bios immediately if kaslr
is enabled and physical randomization failed to faind a new position
for kernel. But nokaslr works in this case.

The reason is kaslr will install a new page table for ident mapping,
while it missed to consider building ident mapping for original area
of kernel if kaslr failed on physical randomization.

In fact bootloaders including kexec/kdump have built ident mapping
for original place of kernel. We can only install new ident mapping
page table when physical kaslr succeeds. Otherwise we just keep the
old page table unchanged just like nokaslr does.

Signed-off-by: Baoquan He <bhe@redhat.com>
Signed-off-by: Dave Young <dyoung@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: x86@kernel.org
Cc: Kees Cook <keescook@chromium.org>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: Borislav Petkov <bp@suse.de>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Thomas Garnier <thgarnie@google.com>
---
 arch/x86/boot/compressed/kaslr.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
index e5eb0c3..7a8b443 100644
--- a/arch/x86/boot/compressed/kaslr.c
+++ b/arch/x86/boot/compressed/kaslr.c
@@ -650,10 +650,16 @@ void choose_random_location(unsigned long input,
 			add_identity_map(random_addr, output_size);
 			*output = random_addr;
 		}
+
+		/*
+		 * This actually loads the identity pagetable on x86_64.
+		 * And this should only be done only if a new position
+		 * is found. Otherwise we should keep the old page table
+		 * to make it be like nokaslr case.
+		 */
+		finalize_identity_maps();
 	}
 
-	/* This actually loads the identity pagetable on x86_64. */
-	finalize_identity_maps();
 
 	/* Pick random virtual address starting from LOAD_PHYSICAL_ADDR. */
 	if (IS_ENABLED(CONFIG_X86_64))
-- 
2.5.5

[toc] | [prev] | [next] | [standalone]

#1631396 — Re: [PATCH 2/2] x86/KASLR: Use old ident map page table if physical randomization failed

On 04/26/17 at 06:39pm, Baoquan He wrote:
> Dave found when kdump kernel will reset to bios immediately if kaslr
	      ^~ this 'when' is redundent, sorry 
> is enabled and physical randomization failed to faind a new position
> for kernel. But nokaslr works in this case.
> 
> The reason is kaslr will install a new page table for ident mapping,
> while it missed to consider building ident mapping for original area
> of kernel if kaslr failed on physical randomization.
> 
> In fact bootloaders including kexec/kdump have built ident mapping
> for original place of kernel. We can only install new ident mapping
> page table when physical kaslr succeeds. Otherwise we just keep the
> old page table unchanged just like nokaslr does.
> 
> Signed-off-by: Baoquan He <bhe@redhat.com>
> Signed-off-by: Dave Young <dyoung@redhat.com>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: x86@kernel.org
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Yinghai Lu <yinghai@kernel.org>
> Cc: Borislav Petkov <bp@suse.de>
> Cc: Dave Jiang <dave.jiang@intel.com>
> Cc: Thomas Garnier <thgarnie@google.com>
> ---
>  arch/x86/boot/compressed/kaslr.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
> index e5eb0c3..7a8b443 100644
> --- a/arch/x86/boot/compressed/kaslr.c
> +++ b/arch/x86/boot/compressed/kaslr.c
> @@ -650,10 +650,16 @@ void choose_random_location(unsigned long input,
>  			add_identity_map(random_addr, output_size);
>  			*output = random_addr;
>  		}
> +
> +		/*
> +		 * This actually loads the identity pagetable on x86_64.
> +		 * And this should only be done only if a new position
> +		 * is found. Otherwise we should keep the old page table
> +		 * to make it be like nokaslr case.
> +		 */
> +		finalize_identity_maps();
>  	}
>  
> -	/* This actually loads the identity pagetable on x86_64. */
> -	finalize_identity_maps();
>  
>  	/* Pick random virtual address starting from LOAD_PHYSICAL_ADDR. */
>  	if (IS_ENABLED(CONFIG_X86_64))
> -- 
> 2.5.5
> 

[toc] | [prev] | [next] | [standalone]

#1631675 — Re: [PATCH 2/2] x86/KASLR: Use old ident map page table if physical randomization failed

On Wed, Apr 26, 2017 at 3:39 AM, Baoquan He <bhe@redhat.com> wrote:
> Dave found when kdump kernel will reset to bios immediately if kaslr
> is enabled and physical randomization failed to faind a new position
> for kernel. But nokaslr works in this case.
>
> The reason is kaslr will install a new page table for ident mapping,
> while it missed to consider building ident mapping for original area
> of kernel if kaslr failed on physical randomization.
>
> In fact bootloaders including kexec/kdump have built ident mapping
> for original place of kernel. We can only install new ident mapping
> page table when physical kaslr succeeds. Otherwise we just keep the
> old page table unchanged just like nokaslr does.
>
> Signed-off-by: Baoquan He <bhe@redhat.com>
> Signed-off-by: Dave Young <dyoung@redhat.com>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: x86@kernel.org
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Yinghai Lu <yinghai@kernel.org>
> Cc: Borislav Petkov <bp@suse.de>
> Cc: Dave Jiang <dave.jiang@intel.com>
> Cc: Thomas Garnier <thgarnie@google.com>

Nice catch!

Acked-by: Kees Cook <keescook@chromium.org>

-Kees

> ---
>  arch/x86/boot/compressed/kaslr.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
> index e5eb0c3..7a8b443 100644
> --- a/arch/x86/boot/compressed/kaslr.c
> +++ b/arch/x86/boot/compressed/kaslr.c
> @@ -650,10 +650,16 @@ void choose_random_location(unsigned long input,
>                         add_identity_map(random_addr, output_size);
>                         *output = random_addr;
>                 }
> +
> +               /*
> +                * This actually loads the identity pagetable on x86_64.
> +                * And this should only be done only if a new position
> +                * is found. Otherwise we should keep the old page table
> +                * to make it be like nokaslr case.
> +                */
> +               finalize_identity_maps();
>         }
>
> -       /* This actually loads the identity pagetable on x86_64. */
> -       finalize_identity_maps();
>
>         /* Pick random virtual address starting from LOAD_PHYSICAL_ADDR. */
>         if (IS_ENABLED(CONFIG_X86_64))
> --
> 2.5.5
>



-- 
Kees Cook
Pixel Security

[toc] | [prev] | [next] | [standalone]

#1631917 — Re: [PATCH 2/2] x86/KASLR: Use old ident map page table if physical randomization failed

On 04/26/17 at 12:12pm, Kees Cook wrote:
> On Wed, Apr 26, 2017 at 3:39 AM, Baoquan He <bhe@redhat.com> wrote:
> > Dave found when kdump kernel will reset to bios immediately if kaslr
> > is enabled and physical randomization failed to faind a new position
> > for kernel. But nokaslr works in this case.
> >
> > The reason is kaslr will install a new page table for ident mapping,
> > while it missed to consider building ident mapping for original area
> > of kernel if kaslr failed on physical randomization.
> >
> > In fact bootloaders including kexec/kdump have built ident mapping
> > for original place of kernel. We can only install new ident mapping
> > page table when physical kaslr succeeds. Otherwise we just keep the
> > old page table unchanged just like nokaslr does.
> >
> > Signed-off-by: Baoquan He <bhe@redhat.com>
> > Signed-off-by: Dave Young <dyoung@redhat.com>
> > Cc: "H. Peter Anvin" <hpa@zytor.com>
> > Cc: Thomas Gleixner <tglx@linutronix.de>
> > Cc: Ingo Molnar <mingo@redhat.com>
> > Cc: x86@kernel.org
> > Cc: Kees Cook <keescook@chromium.org>
> > Cc: Yinghai Lu <yinghai@kernel.org>
> > Cc: Borislav Petkov <bp@suse.de>
> > Cc: Dave Jiang <dave.jiang@intel.com>
> > Cc: Thomas Garnier <thgarnie@google.com>
> 
> Nice catch!
> 
> Acked-by: Kees Cook <keescook@chromium.org>

Thanks, Kees.

Seems I forget telling this only happens in kexec/kdump kernel. Since
the ident mapping has been built for kexec/kdump in 1st kernel for the
whole memory by calling init_pgtable(). Here if physical randomizaiton
failed, it won't build ident mapping for the original area of kernel but
change to new page table '_pgtable'. Then kernel will reset to bios
immediately caused by no ident mapping.

While normal kernel won't be impacted because it comes here via
startup_32() and cr3 will be _pgtable already. In startup_32() ident
mapping is built for 0~4G area. In kaslr We just append to the existing
area instead of entirely overwriting it for on-demand ident mapping
building. So ident mapping for the original area of kernel is still
there.

I will post v2 with a improved patch log, and with your Acked-by.

> 
> -Kees
> 
> > ---
> >  arch/x86/boot/compressed/kaslr.c | 10 ++++++++--
> >  1 file changed, 8 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
> > index e5eb0c3..7a8b443 100644
> > --- a/arch/x86/boot/compressed/kaslr.c
> > +++ b/arch/x86/boot/compressed/kaslr.c
> > @@ -650,10 +650,16 @@ void choose_random_location(unsigned long input,
> >                         add_identity_map(random_addr, output_size);
> >                         *output = random_addr;
> >                 }
> > +
> > +               /*
> > +                * This actually loads the identity pagetable on x86_64.
> > +                * And this should only be done only if a new position
> > +                * is found. Otherwise we should keep the old page table
> > +                * to make it be like nokaslr case.
> > +                */
> > +               finalize_identity_maps();
> >         }
> >
> > -       /* This actually loads the identity pagetable on x86_64. */
> > -       finalize_identity_maps();
> >
> >         /* Pick random virtual address starting from LOAD_PHYSICAL_ADDR. */
> >         if (IS_ENABLED(CONFIG_X86_64))
> > --
> > 2.5.5
> >
> 
> 
> 
> -- 
> Kees Cook
> Pixel Security

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web