linux-kernel - Re: 4.17.x won't boot due to "x86/boot/compressed/64: Handle 5-level paging boot if kernel is above 4G"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <f1fb3e5e-f18a-9f89-84c5-1dc73e08ceef@real-time-systems.com>
Date:   Wed, 25 Jul 2018 19:26:02 +0200
From:   Dmitry Malkin <d.malkin@...l-time-systems.com>
To:     linux-x86_64@...r.kernel.org, linux-kernel@...r.kernel.org,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Ingo Molnar <mingo@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org
Subject: Re: 4.17.x won't boot due to "x86/boot/compressed/64: Handle 5-level
 paging boot if kernel is above 4G"

there may be some other reasons which may cause undefined behavior 
(reboot for example):

in arch/x86/boot/compressed/pgtable_64.c in function paging_prepare():

1. structure "paging_config" allocated on stack without setting default 
value for flag "l5_required":
 >>struct paging_config paging_config = {};
l5_required is set only if CONFIG_X86_5LEVEL is defined

2. reading from memory which may be reserved in case of EFI systems:
 >>    ebda_start = *(unsigned short *)0x40e << 4;
 >>    bios_start = *(unsigned short *)0x413 << 10;
Also, on EFI system without CSM it will results in all zeros. Which will 
place trampoline_start to 0x9d000. And it also may be reserved memory. 
In fact I have such system and it is causes instant reboot (when code 
starts copying to "trampoline_start").

3. paging_prepare(void) returns "struct paging_config". Copy by value. 
Is it really specified by ABI or GCC itself that the second field (which 
is flag "l5_required") will go to RDX register?