[PATCH] x86, kaslr: avoid setup_data when picking location

[PATCH] x86, kaslr: avoid setup_data when picking location

[Kees Cook]

The KASLR location-choosing logic needs to avoid the setup_data list
memory areas as well. Without this, it would be possible to have the
ASLR position stomp on the memory, ultimately causing the boot to fail.

Signed-off-by: Kees Cook <keescook@chromium.org>
Tested-by: Baoquan He <bhe@redhat.com>
Cc: stable@vger.kernel.org
---
 arch/x86/boot/compressed/aslr.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/arch/x86/boot/compressed/aslr.c b/arch/x86/boot/compressed/aslr.c
index fc6091abedb7..d39189ba7f8e 100644
--- a/arch/x86/boot/compressed/aslr.c
+++ b/arch/x86/boot/compressed/aslr.c
@@ -183,12 +183,27 @@ static void mem_avoid_init(unsigned long input, unsigned long input_size,
 static bool mem_avoid_overlap(struct mem_vector *img)
 {
 	int i;
+	struct setup_data *ptr;
 
 	for (i = 0; i < MEM_AVOID_MAX; i++) {
 		if (mem_overlaps(img, &mem_avoid[i]))
 			return true;
 	}
 
+	/* Avoid all entries in the setup_data linked list. */
+	ptr = (struct setup_data *)(unsigned long)real_mode->hdr.setup_data;
+	while (ptr) {
+		struct mem_vector avoid;
+
+		avoid.start = (u64)ptr;
+		avoid.size = sizeof(*ptr) + ptr->len;
+
+		if (mem_overlaps(img, &avoid))
+			return true;
+
+		ptr = (struct setup_data *)(unsigned long)ptr->next;
+	}
+
 	return false;
 }
 
-- 
1.9.1


-- 
Kees Cook
Chrome OS Security

[tip:x86/urgent] x86/kaslr: Avoid the setup_data area when picking location

[tip-bot for Kees Cook]

Commit-ID:  0cacbfbeb5077b63d5d3cf6df88b14ac12ad584b
Gitweb:     http://git.kernel.org/tip/0cacbfbeb5077b63d5d3cf6df88b14ac12ad584b
Author:     Kees Cook <keescook@chromium.org>
AuthorDate: Thu, 11 Sep 2014 09:19:31 -0700
Committer:  Ingo Molnar <mingo@kernel.org>
CommitDate: Fri, 19 Sep 2014 13:04:29 +0200

x86/kaslr: Avoid the setup_data area when picking location

The KASLR location-choosing logic needs to avoid the setup_data
list memory areas as well. Without this, it would be possible to
have the ASLR position stomp on the memory, ultimately causing
the boot to fail.

Signed-off-by: Kees Cook <keescook@chromium.org>
Tested-by: Baoquan He <bhe@redhat.com>
Cc: stable@vger.kernel.org
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: http://lkml.kernel.org/r/20140911161931.GA12001@www.outflux.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/boot/compressed/aslr.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/arch/x86/boot/compressed/aslr.c b/arch/x86/boot/compressed/aslr.c
index fc6091a..d39189b 100644
--- a/arch/x86/boot/compressed/aslr.c
+++ b/arch/x86/boot/compressed/aslr.c
@@ -183,12 +183,27 @@ static void mem_avoid_init(unsigned long input, unsigned long input_size,
 static bool mem_avoid_overlap(struct mem_vector *img)
 {
 	int i;
+	struct setup_data *ptr;
 
 	for (i = 0; i < MEM_AVOID_MAX; i++) {
 		if (mem_overlaps(img, &mem_avoid[i]))
 			return true;
 	}
 
+	/* Avoid all entries in the setup_data linked list. */
+	ptr = (struct setup_data *)(unsigned long)real_mode->hdr.setup_data;
+	while (ptr) {
+		struct mem_vector avoid;
+
+		avoid.start = (u64)ptr;
+		avoid.size = sizeof(*ptr) + ptr->len;
+
+		if (mem_overlaps(img, &avoid))
+			return true;
+
+		ptr = (struct setup_data *)(unsigned long)ptr->next;
+	}
+
 	return false;
 }
 

Re: [PATCH] x86, kaslr: avoid setup_data when picking location

[H. Peter Anvin]

On 09/11/2014 09:19 AM, Kees Cook wrote:
> --- a/arch/x86/boot/compressed/aslr.c
> +++ b/arch/x86/boot/compressed/aslr.c
> @@ -183,12 +183,27 @@ static void mem_avoid_init(unsigned long input, unsigned long input_size,
>  static bool mem_avoid_overlap(struct mem_vector *img)
>  {
>  	int i;
> +	struct setup_data *ptr;
>  
>  	for (i = 0; i < MEM_AVOID_MAX; i++) {
>  		if (mem_overlaps(img, &mem_avoid[i]))
>  			return true;
>  	}
>  
> +	/* Avoid all entries in the setup_data linked list. */
> +	ptr = (struct setup_data *)(unsigned long)real_mode->hdr.setup_data;
> +	while (ptr) {
> +		struct mem_vector avoid;
> +
> +		avoid.start = (u64)ptr;
> +		avoid.size = sizeof(*ptr) + ptr->len;
> +
> +		if (mem_overlaps(img, &avoid))
> +			return true;
> +
> +		ptr = (struct setup_data *)(unsigned long)ptr->next;
> +	}
> +
>  	return false;
>  }
>  
> 

The use of (u64) in the assignment to avoid.start gives a nuisance
warning on 32 bits.

	-hpa

Re: [PATCH] x86, kaslr: avoid setup_data when picking location

[Kees Cook]

On Wed, Oct 1, 2014 at 11:01 AM, H. Peter Anvin <hpa@zytor.com> wrote:
> On 09/11/2014 09:19 AM, Kees Cook wrote:
>> --- a/arch/x86/boot/compressed/aslr.c
>> +++ b/arch/x86/boot/compressed/aslr.c
>> @@ -183,12 +183,27 @@ static void mem_avoid_init(unsigned long input, unsigned long input_size,
>>  static bool mem_avoid_overlap(struct mem_vector *img)
>>  {
>>       int i;
>> +     struct setup_data *ptr;
>>
>>       for (i = 0; i < MEM_AVOID_MAX; i++) {
>>               if (mem_overlaps(img, &mem_avoid[i]))
>>                       return true;
>>       }
>>
>> +     /* Avoid all entries in the setup_data linked list. */
>> +     ptr = (struct setup_data *)(unsigned long)real_mode->hdr.setup_data;
>> +     while (ptr) {
>> +             struct mem_vector avoid;
>> +
>> +             avoid.start = (u64)ptr;
>> +             avoid.size = sizeof(*ptr) + ptr->len;
>> +
>> +             if (mem_overlaps(img, &avoid))
>> +                     return true;
>> +
>> +             ptr = (struct setup_data *)(unsigned long)ptr->next;
>> +     }
>> +
>>       return false;
>>  }
>>
>>
>
> The use of (u64) in the assignment to avoid.start gives a nuisance
> warning on 32 bits.

Ah, good catch! This should be (unsigned long), I think. Shall I send
a follow-up patch, or do you want to fix this directly?

-Kees

-- 
Kees Cook
Chrome OS Security

Re: [PATCH] x86, kaslr: avoid setup_data when picking location

[H. Peter Anvin]

On 10/01/2014 11:08 AM, Kees Cook wrote:
>>
>> The use of (u64) in the assignment to avoid.start gives a nuisance
>> warning on 32 bits.
> 
> Ah, good catch! This should be (unsigned long), I think. Shall I send
> a follow-up patch, or do you want to fix this directly?
> 

Please do.

In theory it is possible for a bootloader to put an object above 4G even
for a 32-bit kernel, but that is likely to break any kind of other
things, so I'm not worried about it.  You don't need to worry about
avoiding such a zone, the problem is mostly that you can't follow the
list any further without adding PAE-handling code.

	-hpa