linux-kernel - Re: [PATCH] kallsyms: fix absolute addresses for kASLR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 25 Feb 2014 11:59:20 +1030
From:	Rusty Russell <rusty@...tcorp.com.au>
To:	Kees Cook <keescook@...omium.org>, linux-kernel@...r.kernel.org
Cc:	Michal Marek <mmarek@...e.cz>, Andi Kleen <andi@...stfloor.org>,
	Fabio Estevam <fabio.estevam@...escale.com>,
	Ming Lei <tom.leiming@...il.com>,
	Andy Honig <ahonig@...gle.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	"H. Peter Anvin" <hpa@...ux.intel.com>, x86@...nel.org,
	Vivek Goyal <vgoyal@...ibm.com>
Subject: Re: [PATCH] kallsyms: fix absolute addresses for kASLR

Kees Cook <keescook@...omium.org> writes:
> From: Andy Honig <ahonig@...gle.com>
>
> Currently symbols that are absolute addresses are incorrectly
> displayed in /proc/kallsyms if the kernel is loaded with kASLR.
>
> The problem was that the scripts/kallsyms.c file which generates
> the array of symbol names and addresses uses an relocatable value
> for all symbols, even absolute symbols.  This patch fixes that.

Hi Andy, Kees,

        This is not a good patch.  See the commit where this was
introduced:

[PATCH] relocatable kernel: Fix kallsyms on avr32 after relocatable kernel changes
    
    o On some platforms like avr32, section init comes before .text and
      not necessarily a symbol's relative position w.r.t _text is positive.
      In such cases assembler detects the overflow and emits warning. This
      patch fixes it.

Did you just break avr32?

And absolute symbols are supposed to be handled in the other branch:

	for (i = 0; i < table_cnt; i++) {
		if (toupper(table[i].sym[0]) != 'A') {
			if (_text <= table[i].addr)
				printf("\tPTR\t_text + %#llx\n",
					table[i].addr - _text);
			else
				printf("\tPTR\t_text - %#llx\n",
					_text - table[i].addr);
		} else {
			printf("\tPTR\t%#llx\n", table[i].addr);
		}
	}

__per_cpu_start is not an absolute symbol anyway.

You need to fix this properly.
Rusty.

> Several kallsyms output in different boot states for comparison:
>
> $ egrep '_(stext|_per_cpu_(start|end))' /root/kallsyms.nokaslr
> 0000000000000000 D __per_cpu_start
> 0000000000014280 D __per_cpu_end
> ffffffff810001c8 T _stext
> $ egrep '_(stext|_per_cpu_(start|end))' /root/kallsyms.kaslr1
> 000000001f200000 D __per_cpu_start
> 000000001f214280 D __per_cpu_end
> ffffffffa02001c8 T _stext
> $ egrep '_(stext|_per_cpu_(start|end))' /root/kallsyms.kaslr2
> 000000000d400000 D __per_cpu_start
> 000000000d414280 D __per_cpu_end
> ffffffff8e4001c8 T _stext
> $ egrep '_(stext|_per_cpu_(start|end))' /root/kallsyms.kaslr-fixed
> 0000000000000000 D __per_cpu_start
> 0000000000014280 D __per_cpu_end
> ffffffffadc001c8 T _stext
>
> Signed-off-by: Andy Honig <ahonig@...gle.com>
> Signed-off-by: Kees Cook <keescook@...omium.org>
> ---
>  scripts/kallsyms.c |    3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
> index 10085de886fe..276e84b8a8e5 100644
> --- a/scripts/kallsyms.c
> +++ b/scripts/kallsyms.c
> @@ -330,8 +330,7 @@ static void write_src(void)
>  				printf("\tPTR\t_text + %#llx\n",
>  					table[i].addr - _text);
>  			else
> -				printf("\tPTR\t_text - %#llx\n",
> -					_text - table[i].addr);
> +				printf("\tPTR\t%#llx\n", table[i].addr);
>  		} else {
>  			printf("\tPTR\t%#llx\n", table[i].addr);
>  		}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/