linux-kernel - [GIT PULL] bootconfig: Extend the magic check range to the preceding 3 bytes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 13 Nov 2020 08:29:30 -0500
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Chen Yu <yu.chen.surf@...il.com>
Subject: [GIT PULL] bootconfig: Extend the magic check range to the
 preceding 3 bytes


Linus,

Fix alignment of bootconfig

GRUB may align the init ramdisk size to 4 bytes, the magic number at the
end of the init ramdisk that denotes bootconfig is attached may not be at
the exact end of the ramdisk. The kernel needs to check back at least 4
bytes.


Please pull the latest trace-v5.10-rc3 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
trace-v5.10-rc3

Tag SHA1: e20c1d4f9314c2296b72a02f3e21c6116099f573
Head SHA1: 50b8a742850fce7293bed45753152c425f7e931b


Masami Hiramatsu (1):
      bootconfig: Extend the magic check range to the preceding 3 bytes

----
 init/main.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)
---------------------------
commit 50b8a742850fce7293bed45753152c425f7e931b
Author: Masami Hiramatsu <mhiramat@...nel.org>
Date:   Fri Nov 13 02:27:31 2020 +0900

    bootconfig: Extend the magic check range to the preceding 3 bytes
    
    Since Grub may align the size of initrd to 4 if user pass
    initrd from cpio, we have to check the preceding 3 bytes as well.
    
    Link: https://lkml.kernel.org/r/160520205132.303174.4876760192433315429.stgit@devnote2
    
    Cc: stable@...r.kernel.org
    Fixes: 85c46b78da58 ("bootconfig: Add bootconfig magic word for indicating bootconfig explicitly")
    Reported-by: Chen Yu <yu.chen.surf@...il.com>
    Tested-by: Chen Yu <yu.chen.surf@...il.com>
    Signed-off-by: Masami Hiramatsu <mhiramat@...nel.org>
    Signed-off-by: Steven Rostedt (VMware) <rostedt@...dmis.org>

diff --git a/init/main.c b/init/main.c
index 130376ec10ba..20baced721ad 100644
--- a/init/main.c
+++ b/init/main.c
@@ -269,14 +269,24 @@ static void * __init get_boot_config_from_initrd(u32 *_size, u32 *_csum)
 	u32 size, csum;
 	char *data;
 	u32 *hdr;
+	int i;
 
 	if (!initrd_end)
 		return NULL;
 
 	data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
-	if (memcmp(data, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN))
-		return NULL;
+	/*
+	 * Since Grub may align the size of initrd to 4, we must
+	 * check the preceding 3 bytes as well.
+	 */
+	for (i = 0; i < 4; i++) {
+		if (!memcmp(data, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN))
+			goto found;
+		data--;
+	}
+	return NULL;
 
+found:
 	hdr = (u32 *)(data - 8);
 	size = hdr[0];
 	csum = hdr[1];