Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753094AbdF0MjX (ORCPT ); Tue, 27 Jun 2017 08:39:23 -0400 Received: from mx1.redhat.com ([209.132.183.28]:43718 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752984AbdF0MjP (ORCPT ); Tue, 27 Jun 2017 08:39:15 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 2C1DD68AD Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=bhe@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 2C1DD68AD From: Baoquan He To: mingo@kernel.org, linux-kernel@vger.kernel.org Cc: tglx@linutronix.de, hpa@zytor.com, Baoquan He Subject: [PATCH v2 1/2] x86/boot/KASLR: Add checking for the offset of kernel virtual address randomization Date: Tue, 27 Jun 2017 20:39:05 +0800 Message-Id: <1498567146-11990-2-git-send-email-bhe@redhat.com> In-Reply-To: <1498567146-11990-1-git-send-email-bhe@redhat.com> References: <1498567146-11990-1-git-send-email-bhe@redhat.com> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Tue, 27 Jun 2017 12:39:15 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1392 Lines: 32 For kernel text KASLR, the virtual address is confined to area of 1G, [0xffffffff80000000, 0xffffffffc0000000). For the implemenataion of virtual address randomization, we only randomize to get an offset between 16M and 1G, then add this offset to the starting address, 0xffffffff80000000. Here 16M is the offset which is decided at linking stage. So the amount of the local variable 'virt_addr' which respresents the offset plus the kernel output size can not exceed KERNEL_IMAGE_SIZE. Add a judgement to check the offset. If out of bounds, print error message and hang there. Suggested-by: Ingo Molnar Signed-off-by: Baoquan He --- arch/x86/boot/compressed/misc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c index b3c5a5f030ce..6008fa9b74d9 100644 --- a/arch/x86/boot/compressed/misc.c +++ b/arch/x86/boot/compressed/misc.c @@ -390,6 +390,8 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap, #ifdef CONFIG_X86_64 if (heap > 0x3fffffffffffUL) error("Destination address too large"); + if (virt_addr + max(output_len, kernel_total_size) > KERNEL_IMAGE_SIZE) + error("Destination virtual address is beyond the kernel mapping area"); #else if (heap > ((-__PAGE_OFFSET-(128<<20)-1) & 0x7fffffff)) error("Destination address too large"); -- 2.5.5