lkml.org 
[lkml]   [2021]   [Jan]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 033/152] MIPS: relocatable: fix possible boot hangup with KASLR enabled
    Date
    From: Alexander Lobakin <alobakin@pm.me>

    commit 69e976831cd53f9ba304fd20305b2025ecc78eab upstream.

    LLVM-built Linux triggered a boot hangup with KASLR enabled.

    arch/mips/kernel/relocate.c:get_random_boot() uses linux_banner,
    which is a string constant, as a random seed, but accesses it
    as an array of unsigned long (in rotate_xor()).
    When the address of linux_banner is not aligned to sizeof(long),
    such access emits unaligned access exception and hangs the kernel.

    Use PTR_ALIGN() to align input address to sizeof(long) and also
    align down the input length to prevent possible access-beyond-end.

    Fixes: 405bc8fd12f5 ("MIPS: Kernel: Implement KASLR using CONFIG_RELOCATABLE")
    Cc: stable@vger.kernel.org # 4.7+
    Signed-off-by: Alexander Lobakin <alobakin@pm.me>
    Tested-by: Nathan Chancellor <natechancellor@gmail.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/mips/kernel/relocate.c | 10 ++++++++--
    1 file changed, 8 insertions(+), 2 deletions(-)

    --- a/arch/mips/kernel/relocate.c
    +++ b/arch/mips/kernel/relocate.c
    @@ -187,8 +187,14 @@ static int __init relocate_exception_tab
    static inline __init unsigned long rotate_xor(unsigned long hash,
    const void *area, size_t size)
    {
    - size_t i;
    - unsigned long *ptr = (unsigned long *)area;
    + const typeof(hash) *ptr = PTR_ALIGN(area, sizeof(hash));
    + size_t diff, i;
    +
    + diff = (void *)ptr - area;
    + if (unlikely(size < diff + sizeof(hash)))
    + return hash;
    +
    + size = ALIGN_DOWN(size - diff, sizeof(hash));

    for (i = 0; i < size / sizeof(hash); i++) {
    /* Rotate by odd number of bits and XOR. */

    \
     
     \ /
      Last update: 2021-01-18 15:34    [W:4.817 / U:0.380 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site