linux-kernel - Re: [PATCH] of/kexec: Omit kaslr-seed when kexecing with nokaslr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 11 Sep 2023 10:22:57 +0800
From:   Song Shuai <songshuaishuai@...ylab.org>
To:     Rob Herring <robh+dt@...nel.org>
Cc:     frowand.list@...il.com, devicetree@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] of/kexec: Omit kaslr-seed when kexecing with nokaslr



在 2023/9/8 22:58, Rob Herring 写道:
> On Fri, Sep 8, 2023 at 5:45 AM Song Shuai <songshuaishuai@...ylab.org> wrote:
>>
>> The chosen node always adds the kaslr-seed property which is needless
>> for the kernels kexeced with the cmdline contained "nokaslr".
>>
>> So omit the kaslr-seed when kexecing with nokaslr.
> 
> The kexec'ed kernel can ignore bootargs with CONFIG_CMDLINE_FORCE. So
> you don't know if kaslr-seed will be used or not.
> 
You are correct. In addition, unlike the EFI Stub, Kexec is unable to
determine whether the kexec'ed kernel supports RANDOMIZE_BASE,
hence it is appropriate to emit the kaslr-seed unconditionally like
those out-of-linux bootloaders.

Apologies for bothering you with this incorrect patch.

>> Signed-off-by: Song Shuai <songshuaishuai@...ylab.org>
>> ---
>>   drivers/of/kexec.c | 15 ++++++++++++---
>>   1 file changed, 12 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c
>> index f26d2ba8a371..c0d53b10cb70 100644
>> --- a/drivers/of/kexec.c
>> +++ b/drivers/of/kexec.c
>> @@ -19,6 +19,7 @@
>>   #include <linux/random.h>
>>   #include <linux/slab.h>
>>   #include <linux/types.h>
>> +#include <linux/string.h>
>>
>>   #define RNG_SEED_SIZE          128
>>
>> @@ -263,6 +264,14 @@ static inline int setup_ima_buffer(const struct kimage *image, void *fdt,
>>   }
>>   #endif /* CONFIG_IMA_KEXEC */
>>
>> +static bool is_nokaslr_cmdline(const char *cmdline)
>> +{
>> +       char *str;
>> +
>> +       str = strstr(cmdline, "nokaslr");
>> +       return str == cmdline || (str > cmdline && *(str - 1) == ' ');
> 
> Yet another copy of the same code. That's a clue to refactor into a
> common function.
> 
> Rob
> 

-- 
Thanks
Song Shuai