All of lore.kernel.org
 help / color / mirror / Atom feed
From: Stefani Seibold <stefani@seibold.net>
To: gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org,
	x86@kernel.org, tglx@linutronix.de, mingo@redhat.com,
	hpa@zytor.com, ak@linux.intel.com, aarcange@redhat.com,
	john.stultz@linaro.org, luto@amacapital.net, xemul@parallels.com,
	gorcunov@openvz.org, andriy.shevchenko@linux.intel.com
Cc: Martin.Runge@rohde-schwarz.com, Andreas.Brief@rohde-schwarz.com,
	Stefani Seibold <stefani@seibold.net>
Subject: [PATCH v21 12/12] x86: Zero-pad the VVAR page
Date: Sun,  2 Mar 2014 10:20:20 +0100	[thread overview]
Message-ID: <1393752020-6740-13-git-send-email-stefani@seibold.net> (raw)
In-Reply-To: <1393752020-6740-1-git-send-email-stefani@seibold.net>

By coincidence, the VVAR page is at the end of an ELF segment.  As a
result, if it ends up being a partial page, the kernel loader will
leave garbage behind at the end of the vvar page.  Zero-pad it to a
full page to fix this issue.

This has probably been broken since the VVAR page was introduced.
On QEMU, if you dump the run-time contents of the VVAR page, you can
find entertaining strings from seabios left behind.

It's remotely possible that this is a security bug -- conceivably
there's some BIOS out there that leaves something sensitive in the
few K of memory that is exposed to userspace.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Stefani Seibold <stefani@seibold.net>
---
 arch/x86/kernel/vmlinux.lds.S | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 1d4897b..49edf2d 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -164,6 +164,11 @@ SECTIONS
 #undef __VVAR_KERNEL_LDS
 #undef EMIT_VVAR
 
+		/*
+		 * Pad the rest of the page with zeros.  Otherwise the loader
+		 * can leave garbage here.
+		 */
+		. = __vvar_beginning_hack + PAGE_SIZE;
 	} :data
 
        . = ALIGN(__vvar_page + PAGE_SIZE, PAGE_SIZE);
-- 
1.9.0


  parent reply	other threads:[~2014-03-02  9:27 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-03-02  9:20 [PATCH v21 00/12] Add 32 bit VDSO time function support Stefani Seibold
2014-03-02  9:20 ` [PATCH v21 01/12] Make vsyscall_gtod_data handling x86 generic Stefani Seibold
2014-03-02  9:20 ` [PATCH v21 02/12] Add new func _install_special_mapping() to mmap.c Stefani Seibold
2014-03-02  9:20 ` [PATCH v21 03/12] revamp vclock_gettime.c Stefani Seibold
2014-03-02  9:20 ` [PATCH v21 04/12] vclock_gettime.c __vdso_clock_gettime cleanup Stefani Seibold
2014-03-02  9:20 ` [PATCH v21 05/12] replace VVAR(vsyscall_gtod_data) by gtod macro Stefani Seibold
2014-03-02  9:20 ` [PATCH v21 06/12] cleanup __vdso_gettimeofday Stefani Seibold
2014-03-02  9:20 ` [PATCH v21 07/12] introduce VVAR marco for vdso32 Stefani Seibold
2014-03-02  9:20 ` [PATCH v21 08/12] Patch alternatives in the 32-bit vDSO Stefani Seibold
2014-03-02  9:20 ` [PATCH v21 09/12] Add 32 bit VDSO time support for 32 bit kernel Stefani Seibold
2014-03-02  9:20 ` [PATCH v21 10/12] Add 32 bit VDSO time support for 64 " Stefani Seibold
2014-03-02  9:20 ` Stefani Seibold [this message]
2014-03-02 10:46   ` [PATCH v21 12/12] x86: Zero-pad the VVAR page Ingo Molnar
2014-03-02 10:47 ` [PATCH v21 00/12] Add 32 bit VDSO time function support Ingo Molnar
2014-03-02 16:32   ` Andy Lutomirski
2014-03-02 21:02     ` H. Peter Anvin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1393752020-6740-13-git-send-email-stefani@seibold.net \
    --to=stefani@seibold.net \
    --cc=Andreas.Brief@rohde-schwarz.com \
    --cc=Martin.Runge@rohde-schwarz.com \
    --cc=aarcange@redhat.com \
    --cc=ak@linux.intel.com \
    --cc=andriy.shevchenko@linux.intel.com \
    --cc=gorcunov@openvz.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=hpa@zytor.com \
    --cc=john.stultz@linaro.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@amacapital.net \
    --cc=mingo@redhat.com \
    --cc=tglx@linutronix.de \
    --cc=x86@kernel.org \
    --cc=xemul@parallels.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.