linux-kernel - kaslr relocation incompitable with kernel loaded high

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 21 Apr 2014 18:52:32 +0800
From:	WANG Chao <chaowang@...hat.com>
To:	Kees Cook <keescook@...omium.org>,
	"H. Peter Anvin" <hpa@...ux.intel.com>,
	Yinghai Lu <yinghai@...nel.org>,
	Zhang Yanfei <zhangyanfei@...fujitsu.com>,
	Vivek Goyal <vgoyal@...hat.com>
Cc:	linux-kernel@...r.kernel.org
Subject: kaslr relocation incompitable with kernel loaded high

Hi, Kees

When I'm testing kaslr with kdump, I find that when 2nd kernel is loaded
high, it doesn't boot.

I reserved 128M memory at high with kernel cmdline
"crashkernel=128M,high crashkernel=0,low", and for which I got:

[    0.000000] Reserving 128MB of memory at 6896MB for crashkernel (System RAM: 6013MB)

Then I load kdump kernel into the reserved memory region, using a local
modified kexec-tools which is passing e820 in boot_params.

The e820 map of system RAM passed to 2nd kernel:

E820 memmap (of RAM):
0000000000001000-000000000009e3ff (1)
00000001af000000-00000001b6f5dfff (1)
00000001b6fff400-00000001b6ffffff (1)

In which, 2nd kernel is loaded at 0x1b5000000.

After triggerred a system crash, 2nd kernel doesn't boot even with
"nokaslr" cmdline:

# echo c > /proc/sysrq-trigger
[..]

I'm in purgatory
early console in decompress_kernel
KASLR disabled...

Decompressing Linux... Parsing ELF... Performing relocations... 

32-bit relocation outside of kernel!

 -- System halted

I know 32bit relocation code has recently moved to misc.c and it's a
ground work for kaslr on x86_64. However it doesn't work out on a kernel
high loaded case.

I'm not quite familiar with this. But I'm wondering if it makes sense to
skip handle_relocation() if kaslr doesn't take effects (nokaslr or
kaslr failed to find suitable area).

Thanks
WANG Chao
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/