Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933612AbbGGWnG (ORCPT ); Tue, 7 Jul 2015 18:43:06 -0400 Received: from mail-ig0-f180.google.com ([209.85.213.180]:34803 "EHLO mail-ig0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932851AbbGGWm5 (ORCPT ); Tue, 7 Jul 2015 18:42:57 -0400 MIME-Version: 1.0 In-Reply-To: <1436300428-21163-13-git-send-email-yinghai@kernel.org> References: <1436300428-21163-1-git-send-email-yinghai@kernel.org> <1436300428-21163-13-git-send-email-yinghai@kernel.org> Date: Tue, 7 Jul 2015 15:42:56 -0700 X-Google-Sender-Auth: 5xXFPz-BqQgtVa2CeuLnBV2xOHk Message-ID: Subject: Re: [PATCH 12/42] x86, kaslr: Fix a bug that relocation can not be handled when kernel is loaded above 2G From: Kees Cook To: Yinghai Lu Cc: "H. Peter Anvin" , Baoquan He , LKML Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1729 Lines: 51 On Tue, Jul 7, 2015 at 1:19 PM, Yinghai Lu wrote: > From: Baoquan He > > When process 32 bit relocation tables a local variable extended is > defined to calculate the physical address of relocs entry. However > it's type is int which is enough for i386, for x86_64 not enough. > That's why relocation can only be handled when kernel is loaded > below 2G, otherwise a overflow will happen and cause system hang. > > Here change it to long as 32 bit inverse relocation processing does, > and this change is safe for i386 relocation handling too. > > Signed-off-by: Baoquan He This looks right, thanks! Acked-by: Kees Cook -Kees > --- > arch/x86/boot/compressed/misc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c > index 83f98a5..bfa4f0a 100644 > --- a/arch/x86/boot/compressed/misc.c > +++ b/arch/x86/boot/compressed/misc.c > @@ -273,7 +273,7 @@ static void handle_relocations(void *output, unsigned long output_len) > * So we work backwards from the end of the decompressed image. > */ > for (reloc = output + output_len - sizeof(*reloc); *reloc; reloc--) { > - int extended = *reloc; > + long extended = *reloc; > extended += map; > > ptr = (unsigned long)extended; > -- > 1.8.4.5 > -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/