From: Nathan Chancellor <natechancellor@gmail.com>
To: Alexander Lobakin <alobakin@pm.me>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>,
Nick Desaulniers <ndesaulniers@google.com>,
Kees Cook <keescook@chromium.org>,
Jinyang He <hejinyang@loongson.cn>,
Ralf Baechle <ralf@linux-mips.org>,
Matt Redfearn <matt.redfearn@mips.com>,
linux-mips@vger.kernel.org, stable@vger.kernel.org,
linux-kernel@vger.kernel.org, clang-built-linux@googlegroups.com
Subject: Re: [PATCH mips-fixes] MIPS: relocatable: fix possible boot hangup with KASLR enabled
Date: Sun, 10 Jan 2021 22:21:46 -0700 [thread overview]
Message-ID: <20210111052146.GA1018564@ubuntu-m3-large-x86> (raw)
In-Reply-To: <20210110142023.185275-1-alobakin@pm.me>
On Sun, Jan 10, 2021 at 02:21:05PM +0000, Alexander Lobakin wrote:
> LLVM-built Linux triggered a boot hangup with KASLR enabled.
>
> arch/mips/kernel/relocate.c:get_random_boot() uses linux_banner,
> which is a string constant, as a random seed, but accesses it
> as an array of unsigned long (in rotate_xor()).
> When the address of linux_banner is not aligned to sizeof(long),
> such access emits unaligned access exception and hangs the kernel.
>
> Use PTR_ALIGN() to align input address to sizeof(long) and also
> align down the input length to prevent possible access-beyond-end.
>
> Fixes: 405bc8fd12f5 ("MIPS: Kernel: Implement KASLR using CONFIG_RELOCATABLE")
> Cc: stable@vger.kernel.org # 4.7+
> Signed-off-by: Alexander Lobakin <alobakin@pm.me>
Apologies for not being familiar enough with the issue to give a review
but I did reproduce the hang that the commit mentions with
malta_kvm_guest_defconfig + CONFIG_RELOCATABLE=y +
CONFIG_RANDOMIZE_BASE=y and this patch does resolve it so:
Tested-by: Nathan Chancellor <natechancellor@gmail.com>
> ---
> arch/mips/kernel/relocate.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/arch/mips/kernel/relocate.c b/arch/mips/kernel/relocate.c
> index 47aeb3350a76..0e365b7c742d 100644
> --- a/arch/mips/kernel/relocate.c
> +++ b/arch/mips/kernel/relocate.c
> @@ -187,8 +187,14 @@ static int __init relocate_exception_table(long offset)
> static inline __init unsigned long rotate_xor(unsigned long hash,
> const void *area, size_t size)
> {
> - size_t i;
> - unsigned long *ptr = (unsigned long *)area;
> + const typeof(hash) *ptr = PTR_ALIGN(area, sizeof(hash));
> + size_t diff, i;
> +
> + diff = (void *)ptr - area;
> + if (unlikely(size < diff + sizeof(hash)))
> + return hash;
> +
> + size = ALIGN_DOWN(size - diff, sizeof(hash));
>
> for (i = 0; i < size / sizeof(hash); i++) {
> /* Rotate by odd number of bits and XOR. */
> --
> 2.30.0
>
>
next prev parent reply other threads:[~2021-01-11 5:22 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-10 14:21 [PATCH mips-fixes] MIPS: relocatable: fix possible boot hangup with KASLR enabled Alexander Lobakin
2021-01-11 5:21 ` Nathan Chancellor [this message]
2021-01-11 19:52 ` Kees Cook
2021-01-13 10:43 ` Thomas Bogendoerfer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210111052146.GA1018564@ubuntu-m3-large-x86 \
--to=natechancellor@gmail.com \
--cc=alobakin@pm.me \
--cc=clang-built-linux@googlegroups.com \
--cc=hejinyang@loongson.cn \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=matt.redfearn@mips.com \
--cc=ndesaulniers@google.com \
--cc=ralf@linux-mips.org \
--cc=stable@vger.kernel.org \
--cc=tsbogend@alpha.franken.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.