Messages in this thread | | | Date | Fri, 12 Jan 2018 10:00:23 +0800 | From | Chao Fan <> | Subject | Re: KASLR may break some kernel features (was Re: [PATCH v5 1/4] kaslr: add immovable_mem=nn[KMG]@ss[KMG] to specify extracting memory) |
| |
On Thu, Jan 11, 2018 at 10:04:56AM -0800, Kees Cook wrote: >On Thu, Jan 11, 2018 at 1:00 AM, Baoquan He <bhe@redhat.com> wrote: >> Hi Luiz, >> >> On 01/04/18 at 11:21am, Luiz Capitulino wrote: >>> Having a generic kaslr parameter to control where the kernel is extracted >>> is one solution for this problem. >>> >>> The general problem statement is that KASLR may break some kernel features >>> depending on where the kernel is extracted. Two examples are hot-plugged >>> memory (this series) and 1GB HugeTLB pages. >>> >>> The 1GB HugeTLB page issue is not specific to KVM guests. It just happens >>> that there's a bunch of people running guests with up to 5GB of memory and >>> with that amount of memory you have one or two 1GB pages and is easier for >>> KASLR to extract the kernel into a 1GB region and split a 1GB page. So, >>> you may not get any 1GB pages at all when this happens. However, I can also >>> reproduce this on bare-metal with lots of memory where I can loose a 1GB >>> page from time to time. >>> >>> Having a kaslr_range= parameter solves both issues, but two major drawbacks >>> is that it breaks existing setups and I guess users will have a very hard >>> time choosing good ranges. >>> >>> Another idea would be to have a CONFIG_KASLR_RANGES, where each arch >>> could have a list of ranges known to contain holes and/or immovable >>> memory and only extract the kernel into those ranges. >> >> If add CONFIG_KASLR_RANGES, then a distro like RHEL will have this range >> always, whether people need hugetlb or not. >> >> So in this case, what range do we need to avoid? Only [1G, 2G]? > >Any ranges like that that need to be avoided should be known at build >time, so they should simply be added to the mem_avoid list that is >already present in the KASLR code... >
Hi Kees,
So this issue can be figured out in a independent patch. And does this patch have any problems? If so, please tell me, I will try my best to improve it.
Thanks, Chao Fan
>-Kees > >-- >Kees Cook >Pixel Security > >
| |