linux-kernel - Re: [PATCH 2/4] kaslr: check if the random addr is available

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 6 Sep 2014 06:16:57 +0800
From:	Baoquan He <bhe@...hat.com>
To:	Kees Cook <keescook@...omium.org>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	Andi Kleen <ak@...ux.intel.com>,
	Ingo Molnar <mingo@...hat.com>,
	Thomas Deutschmann <whissi@...ssi.de>,
	Dave Young <dyoung@...hat.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Vivek Goyal <vgoyal@...hat.com>,
	WANG Chao <chaowang@...hat.com>
Subject: Re: [PATCH 2/4] kaslr: check if the random addr is available

On 09/05/14 at 10:16am, Kees Cook wrote:
> On Fri, Sep 5, 2014 at 7:08 AM, Baoquan He <bhe@...hat.com> wrote:
> > diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
> > index 7780a5b..d2a0eaa 100644
> > --- a/arch/x86/boot/compressed/misc.c
> > +++ b/arch/x86/boot/compressed/misc.c
> > @@ -250,6 +250,11 @@ static void handle_relocations(void *output, unsigned long output_len)
> >         }
> >  #endif
> >
> > +       if (max_addr > CONFIG_RANDOMIZE_BASE_MAX_OFFSET) {
> > +                debug_putstr("Random addr is not allowed. No relocation needed... \n");
> > +                return;
> > +        }
> > +
> 
> It's not clear to me what this is fixing. In aslr.c,
> process_e820_entry() should already make it impossible to select
> max_addr > CONFIG_RANDOMIZE_BASE_MAX_OFFSET. If you're trying to
> detect a non-kaslr boot, I think this is better handled in 1/4 where I
> suggest examining the "output" location before/after
> choose_kernel_location.
> 
> -Kees

Hi Kees,

Yes, process_e820_entry() can make sure the choice+output_len <
CONFIG_RANDOMIZE_BASE_MAX_OFFSET, but that can't stop other bootloaders
to put kernel in region above CONFIG_RANDOMIZE_BASE_MAX_OFFSET.

E.g in kdump, we can set crashkernel=256M@...4M in cmdline. Then the 1st
kernel will reserve 256M memory just at 1024M place. So if load kdump
kernel now, the output will be 1024M before choose_kernel_location().
With this value, output won't be changed in choose_kernel_location(),
then it will do decompress(), then call handle_relocations(). Then since
1024 is not equal to LOAD_PHYSICAL_ADDR, it will start relocatoins
handling. And this cause _text stamping into MODULES vaddr range. System
will be exceptional.

Thanks
Baoquan
> 
> >         /*
> >          * Calculate the delta between where vmlinux was linked to load
> >          * and where it was actually loaded.
> > --
> > 1.8.5.3
> >
> 
> 
> 
> -- 
> Kees Cook
> Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/