Received: by 2002:a25:683:0:0:0:0:0 with SMTP id 125csp109209ybg; Mon, 8 Jun 2020 17:51:32 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwQAzZaLzHh0tFF+tUAhYEIvH5ZhBmh40No40tQxYgO2B07y5k7sMac20al7SUQF6jyz8WL X-Received: by 2002:a05:6402:31bb:: with SMTP id dj27mr25044439edb.156.1591663892536; Mon, 08 Jun 2020 17:51:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1591663892; cv=none; d=google.com; s=arc-20160816; b=jEv13DeZkG45Hjlv3gPyGGil9ibIshhbVe9amvKdDn3JyZv7JBOmrIlZ0WDbfmal2J JX9N227fSBqvU97+CQb6GB4O1e6i3qXBv8Rn+oibRNSWHE6Qz6d2c2C4pOFM09SLkeL+ TDe1w0/V4dStuB8lZXD5J4hBHaZ4ZBzbThThUvZWdNrZBA6vMjCjv1WSIKJNjxdJbvL0 Lv6DLVBWwyVxCfr4H0tXb30qmorso5tcGHuGBZc4PODxxvf8CzYGwV/yNrUgPC9w/CKl oDsqArGeUb2el2oXG0dvLhxdEQbBU6x6mSsvjnGPAMzVBKk7i0qG8+M9ruCBmmIkmD23 l6jw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=Ys+hKlbNYoFSfvagwRaxd/LrT25kO4hVw16JvJCwhHE=; b=lPjzGURfbz6CzK5l3ElIAerSxk6l6pRVrze65PAi2vyjsHBveBcGbYMOEUGxAQBa/j 9stonkt+ArlSe5Vn6lXqQkOCQ+Gz8Cp2eXkNOiIR3Oqs1Y/1dHwd41BXsTzl+3LSg73a ffMS2EFTdUglTpBm/bwyS10UA9OoTtIXhEk79j053Vd0sVxrPfJ1vao5EVTt7fCCTlWT sugSQjyZJHc5BSj76R8Ahfex106EgKwwE5yG6tpsGwM3rNz8YGdGytnNon6Np5/j+hU3 sigmsW+j6ppvBV94VO3KqKZBbwxh+6SPY2MOfPRM0uQSqgrk2HWNed/gRDFVZdBBhFod OiJQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=glgcZjDk; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id qq18si9599072ejb.195.2020.06.08.17.51.09; Mon, 08 Jun 2020 17:51:32 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=glgcZjDk; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730685AbgFIAtU (ORCPT + 99 others); Mon, 8 Jun 2020 20:49:20 -0400 Received: from mail.kernel.org ([198.145.29.99]:56910 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728769AbgFHXKr (ORCPT ); Mon, 8 Jun 2020 19:10:47 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8784C208FE; Mon, 8 Jun 2020 23:10:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591657847; bh=gJS+b6GNXzHhvclf1Xkyzwi8iPGNLwhFWy7di66hKhA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=glgcZjDkYUkpaE2rStqQn4imHhkjEFT/Ze5UXxhnIq9Q+59IUcHaTqQxHN8J7zm39 7N5DVewEftxT1bQFgu6RhwsdDqVAu1XpptJ3FyBq1FzUtDdE+LB7hTYDAi8ylmUfez PUHSNk32SzdmrxLPkA4mdFwXXNkVMBsAk/7i2JM4= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Arvind Sankar , Borislav Petkov , Sasha Levin Subject: [PATCH AUTOSEL 5.7 213/274] x86/boot: Correct relocation destination on old linkers Date: Mon, 8 Jun 2020 19:05:06 -0400 Message-Id: <20200608230607.3361041-213-sashal@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200608230607.3361041-1-sashal@kernel.org> References: <20200608230607.3361041-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Arvind Sankar [ Upstream commit 5214028dd89e49ba27007c3ee475279e584261f0 ] For the 32-bit kernel, as described in 6d92bc9d483a ("x86/build: Build compressed x86 kernels as PIE"), pre-2.26 binutils generates R_386_32 relocations in PIE mode. Since the startup code does not perform relocation, any reloc entry with R_386_32 will remain as 0 in the executing code. Commit 974f221c84b0 ("x86/boot: Move compressed kernel to the end of the decompression buffer") added a new symbol _end but did not mark it hidden, which doesn't give the correct offset on older linkers. This causes the compressed kernel to be copied beyond the end of the decompression buffer, rather than flush against it. This region of memory may be reserved or already allocated for other purposes by the bootloader. Mark _end as hidden to fix. This changes the relocation from R_386_32 to R_386_RELATIVE even on the pre-2.26 binutils. For 64-bit, this is not strictly necessary, as the 64-bit kernel is only built as PIE if the linker supports -z noreloc-overflow, which implies binutils-2.27+, but for consistency, mark _end as hidden here too. The below illustrates the before/after impact of the patch using binutils-2.25 and gcc-4.6.4 (locally compiled from source) and QEMU. Disassembly before patch: 48: 8b 86 60 02 00 00 mov 0x260(%esi),%eax 4e: 2d 00 00 00 00 sub $0x0,%eax 4f: R_386_32 _end Disassembly after patch: 48: 8b 86 60 02 00 00 mov 0x260(%esi),%eax 4e: 2d 00 f0 76 00 sub $0x76f000,%eax 4f: R_386_RELATIVE *ABS* Dump from extract_kernel before patch: early console in extract_kernel input_data: 0x0207c098 <--- this is at output + init_size input_len: 0x0074fef1 output: 0x01000000 output_len: 0x00fa63d0 kernel_total_size: 0x0107c000 needed_size: 0x0107c000 Dump from extract_kernel after patch: early console in extract_kernel input_data: 0x0190d098 <--- this is at output + init_size - _end input_len: 0x0074fef1 output: 0x01000000 output_len: 0x00fa63d0 kernel_total_size: 0x0107c000 needed_size: 0x0107c000 Fixes: 974f221c84b0 ("x86/boot: Move compressed kernel to the end of the decompression buffer") Signed-off-by: Arvind Sankar Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/20200207214926.3564079-1-nivedita@alum.mit.edu Signed-off-by: Sasha Levin --- arch/x86/boot/compressed/head_32.S | 5 +++-- arch/x86/boot/compressed/head_64.S | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S index ab3307036ba4..03557f2174bf 100644 --- a/arch/x86/boot/compressed/head_32.S +++ b/arch/x86/boot/compressed/head_32.S @@ -49,16 +49,17 @@ * Position Independent Executable (PIE) so that linker won't optimize * R_386_GOT32X relocation to its fixed symbol address. Older * linkers generate R_386_32 relocations against locally defined symbols, - * _bss, _ebss, _got and _egot, in PIE. It isn't wrong, just less + * _bss, _ebss, _got, _egot and _end, in PIE. It isn't wrong, just less * optimal than R_386_RELATIVE. But the x86 kernel fails to properly handle * R_386_32 relocations when relocating the kernel. To generate - * R_386_RELATIVE relocations, we mark _bss, _ebss, _got and _egot as + * R_386_RELATIVE relocations, we mark _bss, _ebss, _got, _egot and _end as * hidden: */ .hidden _bss .hidden _ebss .hidden _got .hidden _egot + .hidden _end __HEAD SYM_FUNC_START(startup_32) diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S index 4f7e6b84be07..76d1d64d51e3 100644 --- a/arch/x86/boot/compressed/head_64.S +++ b/arch/x86/boot/compressed/head_64.S @@ -42,6 +42,7 @@ .hidden _ebss .hidden _got .hidden _egot + .hidden _end __HEAD .code32 -- 2.25.1