Messages in this thread | | | Date | Tue, 8 Mar 2016 10:16:15 -0800 | Subject | Re: [PATCH v3 07/19] x86, kaslr: Get correct max_addr for relocs pointer | From | Kees Cook <> |
| |
On Mon, Mar 7, 2016 at 9:13 PM, Baoquan He <bhe@redhat.com> wrote: > On 03/07/16 at 03:16pm, Kees Cook wrote: >> On Fri, Mar 4, 2016 at 8:25 AM, Baoquan He <bhe@redhat.com> wrote: >> > From: Yinghai Lu <yinghai@kernel.org> >> > >> > There is boundary checking for pointer in kaslr relocation handling. >> > >> > Current code is using output_len, and that is VO (vmlinux after objcopy) >> > file size plus vmlinux.relocs file size. >> > >> > That is not right, as we should use loaded address for running. >> >> I think this needs clarification. If I'm understanding correctly, the >> max_addr check should stop at the end of VO, and not include bss, brk, >> etc. which follows. In which case, this change is correct: the bounds >> checking needed to be tightened. > > Yes, exactly as you means. > >> >> >> > >> > At that time parse_elf already move the sections according to ELF headers. >> > >> > The valid range should be VO [_text, __bss_start) loaded physical addresses. > > I think it is expressed here. Maybe we can stress it in this patch log. > After all it's the main idea of this patch. > > How about rewriting patch log like this: > > ******************** > There is boundary checking for pointer in kaslr relocation handling. > However current code is using output_len that is VO (vmlinux after objcopy) > file size plus vmlinux.relocs file size to make the valid boundary. > > That is not right since the max_addr check should stop at the end of VO > and excludes bss, brk etc, which follows. Means the valid range should > be VO [_text, __bss_start] in loaded physical address space. > > In this patch, add export for __bss_start to voffset.h and use it to get > max_addr. > ********************
I would say:
Relocation handling performs bounds checking on the relocated addresses. The existing code uses output_len (VO size plus relocs size) as the max address. This is not right since the max_addr check should stop at the end of VO and exclude bss, brk, etc, which follows. The valid range should be VO [_text, __bss_start] in the loaded physical address space.
In this patch, add export for __bss_start to voffset.h and use it to get the correct max_addr.
Thanks!
-Kees
> >> > >> > In the patch, add export for __bss_start to voffset.h and use it to get >> > max_addr. >> > >> > Signed-off-by: Yinghai Lu <yinghai@kernel.org> >> > --- >> > v2->v3: >> > Tune the patch log. >> > >> > arch/x86/boot/compressed/Makefile | 2 +- >> > arch/x86/boot/compressed/misc.c | 2 +- >> > 2 files changed, 2 insertions(+), 2 deletions(-) >> > >> > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile >> > index fef80fa..2e7c0ce 100644 >> > --- a/arch/x86/boot/compressed/Makefile >> > +++ b/arch/x86/boot/compressed/Makefile >> > @@ -41,7 +41,7 @@ LDFLAGS_vmlinux := -T >> > hostprogs-y := mkpiggy >> > HOST_EXTRACFLAGS += -I$(srctree)/tools/include >> > >> > -sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' >> > +sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p' >> > >> > quiet_cmd_voffset = VOFFSET $@ >> > cmd_voffset = $(NM) $< | sed -n $(sed-voffset) > $@ >> > diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c >> > index 069120e..dd7ed8a 100644 >> > --- a/arch/x86/boot/compressed/misc.c >> > +++ b/arch/x86/boot/compressed/misc.c >> > @@ -259,7 +259,7 @@ static void handle_relocations(void *output, unsigned long output_len) >> > int *reloc; >> > unsigned long delta, map, ptr; >> > unsigned long min_addr = (unsigned long)output; >> > - unsigned long max_addr = min_addr + output_len; >> > + unsigned long max_addr = min_addr + (VO___bss_start - VO__text); >> > >> > /* >> > * Calculate the delta between where vmlinux was linked to load >> > -- >> > 2.5.0 >> > >> >> >> >> -- >> Kees Cook >> Chrome OS & Brillo Security
-- Kees Cook Chrome OS & Brillo Security
| |