Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752244AbdF3NM0 (ORCPT ); Fri, 30 Jun 2017 09:12:26 -0400 Received: from terminus.zytor.com ([65.50.211.136]:40629 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751689AbdF3NMY (ORCPT ); Fri, 30 Jun 2017 09:12:24 -0400 Date: Fri, 30 Jun 2017 06:07:56 -0700 From: tip-bot for Baoquan He Message-ID: Cc: mingo@kernel.org, tglx@linutronix.de, linux-kernel@vger.kernel.org, bhe@redhat.com, torvalds@linux-foundation.org, peterz@infradead.org, hpa@zytor.com Reply-To: mingo@kernel.org, tglx@linutronix.de, linux-kernel@vger.kernel.org, bhe@redhat.com, torvalds@linux-foundation.org, peterz@infradead.org, hpa@zytor.com In-Reply-To: <1498567146-11990-2-git-send-email-bhe@redhat.com> References: <1498567146-11990-2-git-send-email-bhe@redhat.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/urgent] x86/boot/KASLR: Add checking for the offset of kernel virtual address randomization Git-Commit-ID: b892cb873ced2af57dc5a018557d128c53ed6ae0 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2019 Lines: 44 Commit-ID: b892cb873ced2af57dc5a018557d128c53ed6ae0 Gitweb: http://git.kernel.org/tip/b892cb873ced2af57dc5a018557d128c53ed6ae0 Author: Baoquan He AuthorDate: Tue, 27 Jun 2017 20:39:05 +0800 Committer: Ingo Molnar CommitDate: Fri, 30 Jun 2017 08:53:14 +0200 x86/boot/KASLR: Add checking for the offset of kernel virtual address randomization For kernel text KASLR, the virtual address is confined to area of 1G, [0xffffffff80000000, 0xffffffffc0000000). For the implemenataion of virtual address randomization, we only randomize to get an offset between 16M and 1G, then add this offset to the starting address, 0xffffffff80000000. Here 16M is the offset which is decided at linking stage. So the amount of the local variable 'virt_addr' which respresents the offset plus the kernel output size can not exceed KERNEL_IMAGE_SIZE. Add a debug check for the offset. If out of bounds, print error message and hang there. Suggested-by: Ingo Molnar Signed-off-by: Baoquan He Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1498567146-11990-2-git-send-email-bhe@redhat.com Signed-off-by: Ingo Molnar --- arch/x86/boot/compressed/misc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c index b3c5a5f0..6008fa9 100644 --- a/arch/x86/boot/compressed/misc.c +++ b/arch/x86/boot/compressed/misc.c @@ -390,6 +390,8 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap, #ifdef CONFIG_X86_64 if (heap > 0x3fffffffffffUL) error("Destination address too large"); + if (virt_addr + max(output_len, kernel_total_size) > KERNEL_IMAGE_SIZE) + error("Destination virtual address is beyond the kernel mapping area"); #else if (heap > ((-__PAGE_OFFSET-(128<<20)-1) & 0x7fffffff)) error("Destination address too large");