Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752493AbaB1ASp (ORCPT ); Thu, 27 Feb 2014 19:18:45 -0500 Received: from mail-pd0-f178.google.com ([209.85.192.178]:40816 "EHLO mail-pd0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752355AbaB1ASm (ORCPT ); Thu, 27 Feb 2014 19:18:42 -0500 From: Andy Lutomirski To: Stefani Seibold , X86 ML , "H. Peter Anvin" Cc: Greg KH , "linux-kernel@vger.kernel.org" , Thomas Gleixner , Ingo Molnar , Andi Kleen , Andrea Arcangeli , John Stultz , Pavel Emelyanov , Cyrill Gorcunov , andriy.shevchenko@linux.intel.com, Martin.Runge@rohde-schwarz.com, Andreas.Brief@rohde-schwarz.com, Andy Lutomirski Subject: [PATCH v2 4/4] x86: Zero-pad the VVAR page Date: Thu, 27 Feb 2014 16:18:15 -0800 Message-Id: <3916f23d922cc8b9d683d9e0e53a5431ac0440dd.1393545985.git.luto@amacapital.net> X-Mailer: git-send-email 1.8.5.3 In-Reply-To: References: In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org By coincidence, the VVAR page is at the end of an ELF segment. As a result, if it ends up being a partial page, the kernel loader will leave garbage behind at the end of the vvar page. Zero-pad it to a full page to fix this issue. This has probably been broken since the VVAR page was introduced. On QEMU, if you dump the run-time contents of the VVAR page, you can find entertaining strings from seabios left behind. It's remotely possible that this is a security bug -- conceivably there's some BIOS out there that leaves something sensitive in the few K of memory that is exposed to userspace. Signed-off-by: Andy Lutomirski --- arch/x86/kernel/vmlinux.lds.S | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S index 1d4897b..49edf2d 100644 --- a/arch/x86/kernel/vmlinux.lds.S +++ b/arch/x86/kernel/vmlinux.lds.S @@ -164,6 +164,11 @@ SECTIONS #undef __VVAR_KERNEL_LDS #undef EMIT_VVAR + /* + * Pad the rest of the page with zeros. Otherwise the loader + * can leave garbage here. + */ + . = __vvar_beginning_hack + PAGE_SIZE; } :data . = ALIGN(__vvar_page + PAGE_SIZE, PAGE_SIZE); -- 1.8.5.3 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/