Messages in this thread | | | From | Kees Cook <> | Date | Wed, 26 Apr 2017 12:12:02 -0700 | Subject | Re: [PATCH 2/2] x86/KASLR: Use old ident map page table if physical randomization failed |
| |
On Wed, Apr 26, 2017 at 3:39 AM, Baoquan He <bhe@redhat.com> wrote: > Dave found when kdump kernel will reset to bios immediately if kaslr > is enabled and physical randomization failed to faind a new position > for kernel. But nokaslr works in this case. > > The reason is kaslr will install a new page table for ident mapping, > while it missed to consider building ident mapping for original area > of kernel if kaslr failed on physical randomization. > > In fact bootloaders including kexec/kdump have built ident mapping > for original place of kernel. We can only install new ident mapping > page table when physical kaslr succeeds. Otherwise we just keep the > old page table unchanged just like nokaslr does. > > Signed-off-by: Baoquan He <bhe@redhat.com> > Signed-off-by: Dave Young <dyoung@redhat.com> > Cc: "H. Peter Anvin" <hpa@zytor.com> > Cc: Thomas Gleixner <tglx@linutronix.de> > Cc: Ingo Molnar <mingo@redhat.com> > Cc: x86@kernel.org > Cc: Kees Cook <keescook@chromium.org> > Cc: Yinghai Lu <yinghai@kernel.org> > Cc: Borislav Petkov <bp@suse.de> > Cc: Dave Jiang <dave.jiang@intel.com> > Cc: Thomas Garnier <thgarnie@google.com>
Nice catch!
Acked-by: Kees Cook <keescook@chromium.org>
-Kees
> --- > arch/x86/boot/compressed/kaslr.c | 10 ++++++++-- > 1 file changed, 8 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c > index e5eb0c3..7a8b443 100644 > --- a/arch/x86/boot/compressed/kaslr.c > +++ b/arch/x86/boot/compressed/kaslr.c > @@ -650,10 +650,16 @@ void choose_random_location(unsigned long input, > add_identity_map(random_addr, output_size); > *output = random_addr; > } > + > + /* > + * This actually loads the identity pagetable on x86_64. > + * And this should only be done only if a new position > + * is found. Otherwise we should keep the old page table > + * to make it be like nokaslr case. > + */ > + finalize_identity_maps(); > } > > - /* This actually loads the identity pagetable on x86_64. */ > - finalize_identity_maps(); > > /* Pick random virtual address starting from LOAD_PHYSICAL_ADDR. */ > if (IS_ENABLED(CONFIG_X86_64)) > -- > 2.5.5 >
-- Kees Cook Pixel Security
| |