linux-kernel - Re: [PATCH] s390/decompressor: fix initrd corruption caused by bss clear

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170313152729.GC5009@osiris>
Date:   Mon, 13 Mar 2017 16:27:29 +0100
From:   Heiko Carstens <heiko.carstens@...ibm.com>
To:     Marcelo Henrique Cerri <marcelo.cerri@...onical.com>
Cc:     Martin Schwidefsky <schwidefsky@...ibm.com>,
        linux-s390@...r.kernel.org,
        Peter Oberparleiter <oberpar@...ux.vnet.ibm.com>,
        Joy Latten <joy.latten@...onical.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] s390/decompressor: fix initrd corruption caused by bss
 clear

On Mon, Mar 13, 2017 at 12:14:58PM -0300, Marcelo Henrique Cerri wrote:
> Reorder the operations in decompress_kernel() to ensure initrd is moved
> to a safe location before the bss section is zeroed.
> 
> During decompression bss can overlap with the initrd and this can
> corrupt the initrd contents depending on the size of the compressed
> kernel (which affects where the initrd is placed by the bootloader) and
> the size of the bss section of the decompressor.
> 
> Also use the correct initrd size when checking for overlaps with
> parmblock.
> 
> Fixes: 06c0dd72aea3 ([S390] fix boot failures with compressed kernels)
> Cc: stable@...r.kernel.org
> Reviewed-by: Joy Latten <joy.latten@...onical.com>
> Reviewed-by: Vineetha HariPai <vineetha.hari.pai@...onical.com>
> Signed-off-by: Marcelo Henrique Cerri <marcelo.cerri@...onical.com>
> ---
>  arch/s390/boot/compressed/misc.c | 35 +++++++++++++++++++----------------
>  1 file changed, 19 insertions(+), 16 deletions(-)

Indeed. I just checked that we currently have 32 bytes within the bss
section of the compressed kernel image, where clearing it would corrupt the
initrd if would be placed directly behind the image.
I will look into the patch tomorrow.

Thanks,
Heiko