linux-kernel - [tip: x86/urgent] x86: Clear .brk area at early boot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 02 Jul 2022 09:54:27 -0000
From:   "tip-bot2 for Juergen Gross" <tip-bot2@...utronix.de>
To:     linux-tip-commits@...r.kernel.org
Cc:     Juergen Gross <jgross@...e.com>, Borislav Petkov <bp@...e.de>,
        x86@...nel.org, linux-kernel@...r.kernel.org
Subject: [tip: x86/urgent] x86: Clear .brk area at early boot

The following commit has been merged into the x86/urgent branch of tip:

Commit-ID:     38fa5479b41376dc9d7f57e71c83514285a25ca0
Gitweb:        https://git.kernel.org/tip/38fa5479b41376dc9d7f57e71c83514285a25ca0
Author:        Juergen Gross <jgross@...e.com>
AuthorDate:    Thu, 30 Jun 2022 09:14:40 +02:00
Committer:     Borislav Petkov <bp@...e.de>
CommitterDate: Fri, 01 Jul 2022 11:11:34 +02:00

x86: Clear .brk area at early boot

The .brk section has the same properties as .bss: it is an alloc-only
section and should be cleared before being used.

Not doing so is especially a problem for Xen PV guests, as the
hypervisor will validate page tables (check for writable page tables
and hypervisor private bits) before accepting them to be used.

Make sure .brk is initially zero by letting clear_bss() clear the brk
area, too.

Signed-off-by: Juergen Gross <jgross@...e.com>
Signed-off-by: Borislav Petkov <bp@...e.de>
Link: https://lore.kernel.org/r/20220630071441.28576-3-jgross@suse.com
---
 arch/x86/kernel/head64.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index e7e2332..6a3cfaf 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -430,6 +430,8 @@ void __init clear_bss(void)
 {
 	memset(__bss_start, 0,
 	       (unsigned long) __bss_stop - (unsigned long) __bss_start);
+	memset(__brk_base, 0,
+	       (unsigned long) __brk_limit - (unsigned long) __brk_base);
 }
 
 static unsigned long get_cmd_line_ptr(void)