lkml.org 
[lkml]   [2016]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH v3 07/19] x86, kaslr: Get correct max_addr for relocs pointer
    From
    On Mon, Mar 7, 2016 at 9:13 PM, Baoquan He <bhe@redhat.com> wrote:
    > On 03/07/16 at 03:16pm, Kees Cook wrote:
    >> On Fri, Mar 4, 2016 at 8:25 AM, Baoquan He <bhe@redhat.com> wrote:
    >> > From: Yinghai Lu <yinghai@kernel.org>
    >> >
    >> > There is boundary checking for pointer in kaslr relocation handling.
    >> >
    >> > Current code is using output_len, and that is VO (vmlinux after objcopy)
    >> > file size plus vmlinux.relocs file size.
    >> >
    >> > That is not right, as we should use loaded address for running.
    >>
    >> I think this needs clarification. If I'm understanding correctly, the
    >> max_addr check should stop at the end of VO, and not include bss, brk,
    >> etc. which follows. In which case, this change is correct: the bounds
    >> checking needed to be tightened.
    >
    > Yes, exactly as you means.
    >
    >>
    >>
    >> >
    >> > At that time parse_elf already move the sections according to ELF headers.
    >> >
    >> > The valid range should be VO [_text, __bss_start) loaded physical addresses.
    >
    > I think it is expressed here. Maybe we can stress it in this patch log.
    > After all it's the main idea of this patch.
    >
    > How about rewriting patch log like this:
    >
    > ********************
    > There is boundary checking for pointer in kaslr relocation handling.
    > However current code is using output_len that is VO (vmlinux after objcopy)
    > file size plus vmlinux.relocs file size to make the valid boundary.
    >
    > That is not right since the max_addr check should stop at the end of VO
    > and excludes bss, brk etc, which follows. Means the valid range should
    > be VO [_text, __bss_start] in loaded physical address space.
    >
    > In this patch, add export for __bss_start to voffset.h and use it to get
    > max_addr.
    > ********************

    I would say:

    Relocation handling performs bounds checking on the relocated
    addresses. The existing code uses output_len (VO size plus relocs
    size) as the max address. This is not right since the max_addr check
    should stop at the end of VO and exclude bss, brk, etc, which follows.
    The valid range should be VO [_text, __bss_start] in the loaded
    physical address space.

    In this patch, add export for __bss_start to voffset.h and use it to
    get the correct max_addr.


    Thanks!

    -Kees

    >
    >> >
    >> > In the patch, add export for __bss_start to voffset.h and use it to get
    >> > max_addr.
    >> >
    >> > Signed-off-by: Yinghai Lu <yinghai@kernel.org>
    >> > ---
    >> > v2->v3:
    >> > Tune the patch log.
    >> >
    >> > arch/x86/boot/compressed/Makefile | 2 +-
    >> > arch/x86/boot/compressed/misc.c | 2 +-
    >> > 2 files changed, 2 insertions(+), 2 deletions(-)
    >> >
    >> > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
    >> > index fef80fa..2e7c0ce 100644
    >> > --- a/arch/x86/boot/compressed/Makefile
    >> > +++ b/arch/x86/boot/compressed/Makefile
    >> > @@ -41,7 +41,7 @@ LDFLAGS_vmlinux := -T
    >> > hostprogs-y := mkpiggy
    >> > HOST_EXTRACFLAGS += -I$(srctree)/tools/include
    >> >
    >> > -sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p'
    >> > +sed-voffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(_text\|__bss_start\|_end\)$$/\#define VO_\2 _AC(0x\1,UL)/p'
    >> >
    >> > quiet_cmd_voffset = VOFFSET $@
    >> > cmd_voffset = $(NM) $< | sed -n $(sed-voffset) > $@
    >> > diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
    >> > index 069120e..dd7ed8a 100644
    >> > --- a/arch/x86/boot/compressed/misc.c
    >> > +++ b/arch/x86/boot/compressed/misc.c
    >> > @@ -259,7 +259,7 @@ static void handle_relocations(void *output, unsigned long output_len)
    >> > int *reloc;
    >> > unsigned long delta, map, ptr;
    >> > unsigned long min_addr = (unsigned long)output;
    >> > - unsigned long max_addr = min_addr + output_len;
    >> > + unsigned long max_addr = min_addr + (VO___bss_start - VO__text);
    >> >
    >> > /*
    >> > * Calculate the delta between where vmlinux was linked to load
    >> > --
    >> > 2.5.0
    >> >
    >>
    >>
    >>
    >> --
    >> Kees Cook
    >> Chrome OS & Brillo Security



    --
    Kees Cook
    Chrome OS & Brillo Security

    \
     
     \ /
      Last update: 2016-03-08 20:01    [W:2.373 / U:0.164 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site