linux-kernel - [tip:x86/boot] x86/KASLR: Handle kernel relocations above 2G correctly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 29 Apr 2016 01:02:55 -0700
From:	tip-bot for Baoquan He <tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	hpa@...or.com, mingo@...nel.org, luto@...capital.net,
	brgerst@...il.com, keescook@...omium.org,
	akpm@...ux-foundation.org, vgoyal@...hat.com,
	torvalds@...ux-foundation.org, bp@...en8.de, peterz@...radead.org,
	tglx@...utronix.de, dyoung@...hat.com, dvlasenk@...hat.com,
	yinghai@...nel.org, bhe@...hat.com, linux-kernel@...r.kernel.org,
	luto@...nel.org
Subject: [tip:x86/boot] x86/KASLR: Handle kernel relocations above 2G
 correctly

Commit-ID:  6f9af75faa1df61e1ee5bea8a787a90605bb528d
Gitweb:     http://git.kernel.org/tip/6f9af75faa1df61e1ee5bea8a787a90605bb528d
Author:     Baoquan He <bhe@...hat.com>
AuthorDate: Thu, 28 Apr 2016 17:09:03 -0700
Committer:  Ingo Molnar <mingo@...nel.org>
CommitDate: Fri, 29 Apr 2016 09:58:26 +0200

x86/KASLR: Handle kernel relocations above 2G correctly

When processing the relocation table, the offset used to calculate the
relocation is an 'int'. This is sufficient for calculating the physical
address of the relocs entry on 32-bit systems and on 64-bit systems when
the relocation is under 2G.

To handle relocations above 2G (seen in situations like kexec, netboot, etc),
this offset needs to be calculated using a 'long' to avoid wrapping and
miscalculating the relocation.

Signed-off-by: Baoquan He <bhe@...hat.com>
[ Rewrote the changelog. ]
Signed-off-by: Kees Cook <keescook@...omium.org>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: Andy Lutomirski <luto@...capital.net>
Cc: Andy Lutomirski <luto@...nel.org>
Cc: Borislav Petkov <bp@...en8.de>
Cc: Brian Gerst <brgerst@...il.com>
Cc: Dave Young <dyoung@...hat.com>
Cc: Denys Vlasenko <dvlasenk@...hat.com>
Cc: H. Peter Anvin <hpa@...or.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Vivek Goyal <vgoyal@...hat.com>
Cc: Yinghai Lu <yinghai@...nel.org>
Cc: lasse.collin@...aani.org
Link: http://lkml.kernel.org/r/1461888548-32439-2-git-send-email-keescook@chromium.org
Signed-off-by: Ingo Molnar <mingo@...nel.org>

Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 arch/x86/boot/compressed/misc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 6dde6cc..4514514 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -232,7 +232,7 @@ static void handle_relocations(void *output, unsigned long output_len)
 	 * So we work backwards from the end of the decompressed image.
 	 */
 	for (reloc = output + output_len - sizeof(*reloc); *reloc; reloc--) {
-		int extended = *reloc;
+		long extended = *reloc;
 		extended += map;

 		ptr = (unsigned long)extended;