linux-kernel - Re: [PATCH] ARM: Fix zImage file size not aligned with CONFIG_EFI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171024092229.GA20805@n2100.armlinux.org.uk>
Date:   Tue, 24 Oct 2017 10:22:29 +0100
From:   Russell King - ARM Linux <linux@...linux.org.uk>
To:     Ard Biesheuvel <ard.biesheuvel@...aro.org>
Cc:     Chris Zhong <chris.zhong@...k-chips.com>,
        jeffy <jeffy.chen@...k-chips.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        Ingo Molnar <mingo@...nel.org>
Subject: Re: [PATCH] ARM: Fix zImage file size not aligned with
 CONFIG_EFI_STUB enabled

On Tue, Oct 24, 2017 at 10:13:09AM +0100, Ard Biesheuvel wrote:
> On 24 October 2017 at 10:09, Russell King - ARM Linux
> <linux@...linux.org.uk> wrote:
> > The question is: do we want to know when additional sections get
> > emitted into the binary?
> 
> Well, we need to know whether the size of zImage is a multiple of 512
> bytes. We could check that separately by adding the following as well
> 
> #ifdef CONFIG_EFI_STUB
> ASSERT((_edata % 512 == 0), "zImage file size is not a multiple of 512 bytes")

ASSERT((_edata - _text) % 512 == 0, "EFI zImage file size is not a multiple of 512 bytes")

This would only catch them when EFI is enabled, which doesn't give very
good build coverage.  I still prefer my solution over adding the assert
and a section for _edata - my solution catches it with EFI disabled as
well.

A variant on that would be this, which should catch additional sections
for EFI and non-EFI:

diff --git a/arch/arm/boot/compressed/vmlinux.lds.S b/arch/arm/boot/compressed/vmlinux.lds.S
index b38dcef90756..9d0c5d80979a 100644
--- a/arch/arm/boot/compressed/vmlinux.lds.S
+++ b/arch/arm/boot/compressed/vmlinux.lds.S
@@ -95,6 +95,10 @@ SECTIONS
 
   _edata = .;
 
+  .image_end (NOLOAD) : {
+    _image_end = .;
+  }
+
   _magic_sig = ZIMAGE_MAGIC(0x016f2818);
   _magic_start = ZIMAGE_MAGIC(_start);
   _magic_end = ZIMAGE_MAGIC(_edata);
@@ -119,3 +123,5 @@ SECTIONS
   .stab.indexstr 0	: { *(.stab.indexstr) }
   .comment 0		: { *(.comment) }
 }
+
+ASSERT(image_end == end, "zImage file size is incorrect")


-- 
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 8.8Mbps down 630kbps up
According to speedtest.net: 8.21Mbps down 510kbps up