linux/arch/x86/boot/compressed
Junjie Mao e6023367d7 x86, kaslr: Prevent .bss from overlaping initrd
When choosing a random address, the current implementation does not take into
account the reversed space for .bss and .brk sections. Thus the relocated kernel
may overlap other components in memory. Here is an example of the overlap from a
x86_64 kernel in qemu (the ranges of physical addresses are presented):

 Physical Address

    0x0fe00000                  --+--------------------+  <-- randomized base
                               /  |  relocated kernel  |
                   vmlinux.bin    | (from vmlinux.bin) |
    0x1336d000    (an ELF file)   +--------------------+--
                               \  |                    |  \
    0x1376d870                  --+--------------------+   |
                                  |    relocs table    |   |
    0x13c1c2a8                    +--------------------+   .bss and .brk
                                  |                    |   |
    0x13ce6000                    +--------------------+   |
                                  |                    |  /
    0x13f77000                    |       initrd       |--
                                  |                    |
    0x13fef374                    +--------------------+

The initrd image will then be overwritten by the memset during early
initialization:

[    1.655204] Unpacking initramfs...
[    1.662831] Initramfs unpacking failed: junk in compressed archive

This patch prevents the above situation by requiring a larger space when looking
for a random kernel base, so that existing logic can effectively avoids the
overlap.

[kees: switched to perl to avoid hex translation pain in mawk vs gawk]
[kees: calculated overlap without relocs table]

Fixes: 82fa9637a2 ("x86, kaslr: Select random position from e820 maps")
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Junjie Mao <eternal.n08@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Josh Triplett <josh@joshtriplett.org>
Cc: Matt Fleming <matt.fleming@intel.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/1414762838-13067-1-git-send-email-eternal.n08@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2014-11-01 22:20:50 +01:00
..
.gitignore x86, boot: add new generated files to the appropriate .gitignore files 2009-06-02 21:13:30 -07:00
aslr.c Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-10-14 02:28:16 +02:00
cmdline.c x86, kaslr: Return location from decompress_kernel 2013-10-13 03:12:07 -07:00
cpuflags.c x86, boot: Rename get_flags() and check_flags() to *_cpuflags() 2013-10-13 04:08:56 -07:00
early_serial_console.c x86, boot: Don't compile early_serial_console.c when !CONFIG_EARLY_PRINTK 2014-08-17 14:58:24 -07:00
eboot.c Merge branch 'next' into efi-next-merge 2014-10-03 22:15:56 +01:00
eboot.h Revert "efi/x86: efistub: Move shared dependencies to <asm/efi.h>" 2014-09-23 22:01:55 +01:00
efi_stub_32.S x86, efi: EFI boot stub support 2011-12-12 14:26:10 -08:00
efi_stub_64.S x86/efi: Add early thunk code to go from 64-bit to 32-bit 2014-03-04 21:25:04 +00:00
head_32.S x86, kaslr: Prevent .bss from overlaping initrd 2014-11-01 22:20:50 +01:00
head_64.S x86, kaslr: Prevent .bss from overlaping initrd 2014-11-01 22:20:50 +01:00
Makefile x86, kaslr: Prevent .bss from overlaping initrd 2014-11-01 22:20:50 +01:00
misc.c x86, kaslr: Prevent .bss from overlaping initrd 2014-11-01 22:20:50 +01:00
misc.h x86, kaslr: Select random position from e820 maps 2013-10-13 03:12:19 -07:00
mkpiggy.c x86, kaslr: Prevent .bss from overlaping initrd 2014-11-01 22:20:50 +01:00
string.c x86, boot: Remove misc.h inclusion from compressed/string.c 2014-05-08 08:00:06 -07:00
vmlinux.lds.S x86, setup: Allow global variables and functions in the decompressor 2010-08-02 15:34:44 -07:00