From: Kees Cook <keescook@chromium.org>
To: Pintu Agarwal <pintu.ping@gmail.com>
Cc: Ard Biesheuvel <ardb@kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
Arnd Bergmann <arnd@arndb.de>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>,
Marc Zyngier <marc.zyngier@arm.com>,
Dave Martin <dave.martin@arm.com>,
Kernelnewbies <kernelnewbies@kernelnewbies.org>,
Russell King - ARM Linux <linux@armlinux.org.uk>,
open list <linux-kernel@vger.kernel.org>,
Tony Lindgren <tony@atomide.com>,
matt@codeblueprint.co.uk, nico@linaro.org,
Thomas Garnier <thgarnie@google.com>,
"moderated list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE"
<linux-arm-kernel@lists.infradead.org>
Subject: Re: KASLR support on ARM with Kernel 4.9 and 4.14
Date: Mon, 28 Sep 2020 12:50:26 -0700 [thread overview]
Message-ID: <202009281248.6F601005CA@keescook> (raw)
In-Reply-To: <CAOuPNLiw1FyzHq2DykRFwgG0BeaWaNymiV8_DmD=ump7P8W_ow@mail.gmail.com>
On Mon, Sep 28, 2020 at 07:41:13PM +0530, Pintu Agarwal wrote:
> On Mon, 28 Sep 2020 at 19:15, Pintu Agarwal <pintu.ping@gmail.com> wrote:
> >
> > On Sat, 26 Sep 2020 at 22:10, Kees Cook <keescook@chromium.org> wrote:
> >
> > > > >> I wonder if this is an Android Common kernel?
> > > > It uses the below kernel for 4.14:
> > > > https://gitlab.com/quicla/kernel/msm-4.14/-/tree/LE.UM.3.4.2.r1.5 (or
> > > > similar branch).
> > >
> > > Okay, so yes. And this appears to have the hashing of %p backported. I
> > > cannot, however, explain why it's showing hashed pointers instead of
> > > just NULL, though.
> > >
> > > It might be related to these commits but they're not in that kernel:
> > > 3e5903eb9cff ("vsprintf: Prevent crash when dereferencing invalid pointers")
> > > 7bd57fbc4a4d ("vsprintf: don't obfuscate NULL and error pointers")
> > >
> > > > ==> The case where symbol addresses are changing.
> > > >
> > > > kptr_restrict is set to 2 by default:
> > > > / # cat /proc/sys/kernel/kptr_restrict
> > > > 2
> > > >
> > > > Basically, the goal is:
> > > > * To understand how addresses are changing in 4.14 Kernel (without
> > > > KASLR support)?
> > > > * Is it possible to support the same in 4.9 Kernel ?
> > >
> > > Try setting kptr_restrict to 0 and see if the symbol addresses change? I
> > > suspect Ard is correct: there's no KASLR here, just hashed pointers
> > > behaving weird on an old non-stock kernel. :)
> > >
> >
> > Okay. Thank you so much for your comments and suggestions.
> > You mean to say, setting kptr_restrict to 0 may avoid changing symbol
> > addresses in 4.14 ?
> > And, sorry, I could not understand the thing about this "hashed pointers".
> > How can I check this behavior in source code to understand better?
> > Is it possible to give some reference ?
> > I wanted to disable this hash pointer on 4.14 kernel and check the behavior.
> > Also if possible, we would like to make this similar change on 4.9
> > kernel as well.
> >
>
> Okay, I found these changes in 4.14 kernel:
> https://gitlab.com/quicla/kernel/msm-4.14/-/commit/e63732dbfe017aa0dbabac9d096b5fde8afbd395
That's an out-of-tree patch. The one that was backported to 4.14 from
4.15 that does %p hashing is this one:
https://gitlab.com/quicla/kernel/msm-4.14/-/commit/ad67b74d2469d9b82aaa572d76474c95bc484d57
> Are we talking about this?
> I cound not find this in 4.9 kernel.
Note that I still can't explain what you're seeing. /proc/kallsyms
shouldn't be affected by these patches -- I would expect it to either
report the true value or 00s.
> I will disable kptr_restrict and check or, I will enable
> CONFIG_DEBUG_CONSOLE_UNHASHED_POINTERS and check.
I would start with kptr_restrict=0 and see if that changes the contents
of /proc/kallsyms. If it does, then it is the hashing. If it doesn't,
well, we're back to square one. :)
--
Kees Cook
next prev parent reply other threads:[~2020-09-28 19:50 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-25 15:03 KASLR support on ARM with Kernel 4.9 and 4.14 Pintu Agarwal
2020-09-25 20:26 ` Kees Cook
2020-09-25 20:37 ` Ard Biesheuvel
2020-09-25 20:47 ` Kees Cook
2020-09-25 21:09 ` Ard Biesheuvel
2020-09-25 23:47 ` Kees Cook
2020-09-26 7:58 ` Pintu Agarwal
2020-09-26 16:40 ` Kees Cook
2020-09-28 13:45 ` Pintu Agarwal
2020-09-28 14:11 ` Pintu Agarwal
2020-09-28 19:50 ` Kees Cook [this message]
2020-09-30 13:58 ` Pintu Agarwal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202009281248.6F601005CA@keescook \
--to=keescook@chromium.org \
--cc=ard.biesheuvel@linaro.org \
--cc=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=dave.martin@arm.com \
--cc=kernelnewbies@kernelnewbies.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@armlinux.org.uk \
--cc=marc.zyngier@arm.com \
--cc=mark.rutland@arm.com \
--cc=matt@codeblueprint.co.uk \
--cc=nico@linaro.org \
--cc=pintu.ping@gmail.com \
--cc=thgarnie@google.com \
--cc=tony@atomide.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).