linux-stable/arch
Junjie Mao e6023367d7 x86, kaslr: Prevent .bss from overlaping initrd
When choosing a random address, the current implementation does not take into
account the reversed space for .bss and .brk sections. Thus the relocated kernel
may overlap other components in memory. Here is an example of the overlap from a
x86_64 kernel in qemu (the ranges of physical addresses are presented):

 Physical Address

    0x0fe00000                  --+--------------------+  <-- randomized base
                               /  |  relocated kernel  |
                   vmlinux.bin    | (from vmlinux.bin) |
    0x1336d000    (an ELF file)   +--------------------+--
                               \  |                    |  \
    0x1376d870                  --+--------------------+   |
                                  |    relocs table    |   |
    0x13c1c2a8                    +--------------------+   .bss and .brk
                                  |                    |   |
    0x13ce6000                    +--------------------+   |
                                  |                    |  /
    0x13f77000                    |       initrd       |--
                                  |                    |
    0x13fef374                    +--------------------+

The initrd image will then be overwritten by the memset during early
initialization:

[    1.655204] Unpacking initramfs...
[    1.662831] Initramfs unpacking failed: junk in compressed archive

This patch prevents the above situation by requiring a larger space when looking
for a random kernel base, so that existing logic can effectively avoids the
overlap.

[kees: switched to perl to avoid hex translation pain in mawk vs gawk]
[kees: calculated overlap without relocs table]

Fixes: 82fa9637a2 ("x86, kaslr: Select random position from e820 maps")
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Junjie Mao <eternal.n08@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Josh Triplett <josh@joshtriplett.org>
Cc: Matt Fleming <matt.fleming@intel.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/1414762838-13067-1-git-send-email-eternal.n08@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
2014-11-01 22:20:50 +01:00
..
alpha Merge git://git.infradead.org/users/eparis/audit 2014-10-19 16:25:56 -07:00
arc The "weak" attribute is commonly used for the default version of a 2014-10-23 15:04:27 -07:00
arm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-10-31 15:04:58 -07:00
arm64 arm64 fixes: 2014-10-24 12:48:04 -07:00
avr32 Merge branch 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma 2014-10-18 18:11:04 -07:00
blackfin Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu 2014-10-15 07:48:18 +02:00
c6x irq_work: Introduce arch_irq_work_has_interrupt() 2014-09-13 18:38:07 +02:00
cris Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-10-13 16:23:15 +02:00
frv frv: remove unused declarations of __start___ex_table and __stop___ex_table 2014-10-14 02:18:28 +02:00
hexagon Merge branch 'locking-arch-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-10-13 15:48:00 +02:00
ia64 Merge branch 'x86-efi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-10-23 14:45:09 -07:00
m32r Merge branch 'locking-arch-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-10-13 15:48:00 +02:00
m68k Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu 2014-10-14 03:51:22 +02:00
metag Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu 2014-10-15 07:48:18 +02:00
microblaze microblaze: Wire up bpf syscall 2014-10-27 09:25:34 +01:00
mips MIPS: SEAD3: Fix I2C device registration. 2014-10-24 13:34:42 +02:00
mn10300 Merge branch 'locking-arch-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-10-13 15:48:00 +02:00
openrisc Merge git://git.infradead.org/users/eparis/audit 2014-10-19 16:25:56 -07:00
parisc Merge git://git.infradead.org/users/eparis/audit 2014-10-19 16:25:56 -07:00
powerpc Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-10-31 14:01:47 -07:00
s390 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-10-31 14:01:47 -07:00
score score: use Kbuild logic to include <asm-generic/sections.h> 2014-10-09 22:25:46 -04:00
sh sh: fix sh770x SCIF memory regions 2014-10-29 16:33:15 -07:00
sparc sparc: Hook up bpf system call. 2014-10-28 11:30:43 -07:00
tile Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu 2014-10-15 07:48:18 +02:00
um Merge git://git.infradead.org/users/eparis/audit 2014-10-19 16:25:56 -07:00
unicore32 nosave: consolidate __nosave_{begin,end} in <asm/sections.h> 2014-10-09 22:26:04 -04:00
x86 x86, kaslr: Prevent .bss from overlaping initrd 2014-11-01 22:20:50 +01:00
xtensa Merge git://git.infradead.org/users/eparis/audit 2014-10-19 16:25:56 -07:00
.gitignore
Kconfig seccomp: Document two-phase seccomp and arch-provided seccomp_data 2014-09-03 14:58:17 -07:00