diff mbox

[V2] ZBOOT: fix stack protector in compressed boot phase

Message ID 1520820258-19225-1-git-send-email-chenhc@lemote.com (mailing list archive)
State New, archived
Headers show

Commit Message

Huacai Chen March 12, 2018, 2:04 a.m. UTC
Call __stack_chk_guard_setup() in decompress_kernel() is too late that
stack checking always fails for decompress_kernel() itself. So remove
__stack_chk_guard_setup() and initialize __stack_chk_guard before we
call decompress_kernel().

Original code comes from ARM but also used for MIPS and SH, so fix them
together. If without this fix, compressed booting of these archs will
fail because stack checking is enabled by default (>=4.16).

V2: Fix build on ARM.

Cc: stable@vger.kernel.org
Signed-off-by: Huacai Chen <chenhc@lemote.com>
---
 arch/arm/boot/compressed/head.S        | 4 ++++
 arch/arm/boot/compressed/misc.c        | 7 -------
 arch/mips/boot/compressed/decompress.c | 7 -------
 arch/mips/boot/compressed/head.S       | 4 ++++
 arch/sh/boot/compressed/head_32.S      | 4 ++++
 arch/sh/boot/compressed/head_64.S      | 4 ++++
 arch/sh/boot/compressed/misc.c         | 7 -------
 7 files changed, 16 insertions(+), 21 deletions(-)

Comments

kernel test robot March 12, 2018, 5:56 a.m. UTC | #1
Hi Huacai,

I love your patch! Yet something to improve:

[auto build test ERROR on linus/master]
[also build test ERROR on v4.16-rc5 next-20180309]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Huacai-Chen/ZBOOT-fix-stack-protector-in-compressed-boot-phase/20180312-114651
config: sh-allnoconfig (attached as .config)
compiler: sh4-linux-gnu-gcc (Debian 7.2.0-11) 7.2.0
reproduce:
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # save the attached .config to linux build tree
        make.cross ARCH=sh 

All errors (new ones prefixed by >>):

   arch/sh/boot/compressed/head_32.S: Assembler messages:
>> arch/sh/boot/compressed/head_32.S:79: Error: pcrel too far
>> arch/sh/boot/compressed/head_32.S:80: Error: offset out of range
>> arch/sh/boot/compressed/head_32.S:80: Error: value of 658943 too large for field of 2 bytes at 102

vim +79 arch/sh/boot/compressed/head_32.S

    12	
    13		.global	startup
    14	startup:
    15		/* Load initial status register */
    16		mov.l   init_sr, r1
    17		ldc     r1, sr
    18	
    19		/* Move myself to proper location if necessary */
    20		mova	1f, r0
    21		mov.l	1f, r2
    22		cmp/eq	r2, r0
    23		bt	clear_bss
    24		sub	r0, r2
    25		mov.l	bss_start_addr, r0
    26		mov	#0xffffffe0, r1
    27		and	r1, r0			! align cache line
    28		mov.l	text_start_addr, r3
    29		mov	r0, r1
    30		sub	r2, r1
    31	3:
    32		mov.l	@r1, r4
    33		mov.l	@(4,r1), r5
    34		mov.l	@(8,r1), r6
    35		mov.l	@(12,r1), r7
    36		mov.l	@(16,r1), r8
    37		mov.l	@(20,r1), r9
    38		mov.l	@(24,r1), r10
    39		mov.l	@(28,r1), r11
    40		mov.l	r4, @r0
    41		mov.l	r5, @(4,r0)
    42		mov.l	r6, @(8,r0)
    43		mov.l	r7, @(12,r0)
    44		mov.l	r8, @(16,r0)
    45		mov.l	r9, @(20,r0)
    46		mov.l	r10, @(24,r0)
    47		mov.l	r11, @(28,r0)
    48	#ifdef CONFIG_CPU_SH4
    49		ocbwb	@r0
    50	#endif
    51		cmp/hi	r3, r0
    52		add	#-32, r0
    53		bt/s	3b
    54		 add	#-32, r1
    55		mov.l	2f, r0
    56		jmp	@r0
    57		 nop
    58	
    59		.align 2
    60	1:	.long	1b
    61	2:	.long	clear_bss
    62	text_start_addr:
    63		.long	startup
    64	
    65		/* Clear BSS */
    66	clear_bss:
    67		mov.l	end_addr, r1
    68		mov.l	bss_start_addr, r2
    69		mov	#0, r0
    70	l1:
    71		mov.l	r0, @-r1
    72		cmp/eq	r1,r2
    73		bf	l1
    74	
    75		/* Set the initial pointer. */
    76		mov.l	init_stack_addr, r0
    77		mov.l	@r0, r15
    78	
  > 79		mov.l	__stack_chk_guard, r0
  > 80		mov	#0x000a0dff, r1

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation
Huacai Chen March 13, 2018, 8:55 a.m. UTC | #2
Hi, Yoshinori, Rich and SuperH developers,

I'm not familiar with SuperH assembly, but SuperH has the same bug
obviously. Could you please fix that?

Huacai

On Mon, Mar 12, 2018 at 10:04 AM, Huacai Chen <chenhc@lemote.com> wrote:
> Call __stack_chk_guard_setup() in decompress_kernel() is too late that
> stack checking always fails for decompress_kernel() itself. So remove
> __stack_chk_guard_setup() and initialize __stack_chk_guard before we
> call decompress_kernel().
>
> Original code comes from ARM but also used for MIPS and SH, so fix them
> together. If without this fix, compressed booting of these archs will
> fail because stack checking is enabled by default (>=4.16).
>
> V2: Fix build on ARM.
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Huacai Chen <chenhc@lemote.com>
> ---
>  arch/arm/boot/compressed/head.S        | 4 ++++
>  arch/arm/boot/compressed/misc.c        | 7 -------
>  arch/mips/boot/compressed/decompress.c | 7 -------
>  arch/mips/boot/compressed/head.S       | 4 ++++
>  arch/sh/boot/compressed/head_32.S      | 4 ++++
>  arch/sh/boot/compressed/head_64.S      | 4 ++++
>  arch/sh/boot/compressed/misc.c         | 7 -------
>  7 files changed, 16 insertions(+), 21 deletions(-)
>
> diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
> index 45c8823..bae1fc6 100644
> --- a/arch/arm/boot/compressed/head.S
> +++ b/arch/arm/boot/compressed/head.S
> @@ -547,6 +547,10 @@ not_relocated:     mov     r0, #0
>                 bic     r4, r4, #1
>                 blne    cache_on
>
> +               ldr     r0, =__stack_chk_guard
> +               ldr     r1, =0x000a0dff
> +               str     r1, [r0]
> +
>  /*
>   * The C runtime environment should now be setup sufficiently.
>   * Set up some pointers, and start decompressing.
> diff --git a/arch/arm/boot/compressed/misc.c b/arch/arm/boot/compressed/misc.c
> index 16a8a80..e518ef5 100644
> --- a/arch/arm/boot/compressed/misc.c
> +++ b/arch/arm/boot/compressed/misc.c
> @@ -130,11 +130,6 @@ asmlinkage void __div0(void)
>
>  unsigned long __stack_chk_guard;
>
> -void __stack_chk_guard_setup(void)
> -{
> -       __stack_chk_guard = 0x000a0dff;
> -}
> -
>  void __stack_chk_fail(void)
>  {
>         error("stack-protector: Kernel stack is corrupted\n");
> @@ -150,8 +145,6 @@ decompress_kernel(unsigned long output_start, unsigned long free_mem_ptr_p,
>  {
>         int ret;
>
> -       __stack_chk_guard_setup();
> -
>         output_data             = (unsigned char *)output_start;
>         free_mem_ptr            = free_mem_ptr_p;
>         free_mem_end_ptr        = free_mem_ptr_end_p;
> diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c
> index fdf99e9..5ba431c 100644
> --- a/arch/mips/boot/compressed/decompress.c
> +++ b/arch/mips/boot/compressed/decompress.c
> @@ -78,11 +78,6 @@ void error(char *x)
>
>  unsigned long __stack_chk_guard;
>
> -void __stack_chk_guard_setup(void)
> -{
> -       __stack_chk_guard = 0x000a0dff;
> -}
> -
>  void __stack_chk_fail(void)
>  {
>         error("stack-protector: Kernel stack is corrupted\n");
> @@ -92,8 +87,6 @@ void decompress_kernel(unsigned long boot_heap_start)
>  {
>         unsigned long zimage_start, zimage_size;
>
> -       __stack_chk_guard_setup();
> -
>         zimage_start = (unsigned long)(&__image_begin);
>         zimage_size = (unsigned long)(&__image_end) -
>             (unsigned long)(&__image_begin);
> diff --git a/arch/mips/boot/compressed/head.S b/arch/mips/boot/compressed/head.S
> index 409cb48..00d0ee0 100644
> --- a/arch/mips/boot/compressed/head.S
> +++ b/arch/mips/boot/compressed/head.S
> @@ -32,6 +32,10 @@ start:
>         bne     a2, a0, 1b
>          addiu  a0, a0, 4
>
> +       PTR_LA  a0, __stack_chk_guard
> +       PTR_LI  a1, 0x000a0dff
> +       sw      a1, 0(a0)
> +
>         PTR_LA  a0, (.heap)          /* heap address */
>         PTR_LA  sp, (.stack + 8192)  /* stack address */
>
> diff --git a/arch/sh/boot/compressed/head_32.S b/arch/sh/boot/compressed/head_32.S
> index 7bb1681..a3fdb05 100644
> --- a/arch/sh/boot/compressed/head_32.S
> +++ b/arch/sh/boot/compressed/head_32.S
> @@ -76,6 +76,10 @@ l1:
>         mov.l   init_stack_addr, r0
>         mov.l   @r0, r15
>
> +       mov.l   __stack_chk_guard, r0
> +       mov     #0x000a0dff, r1
> +       mov.l   r1, @r0
> +
>         /* Decompress the kernel */
>         mov.l   decompress_kernel_addr, r0
>         jsr     @r0
> diff --git a/arch/sh/boot/compressed/head_64.S b/arch/sh/boot/compressed/head_64.S
> index 9993113..8b4d540 100644
> --- a/arch/sh/boot/compressed/head_64.S
> +++ b/arch/sh/boot/compressed/head_64.S
> @@ -132,6 +132,10 @@ startup:
>         addi    r22, 4, r22
>         bne     r22, r23, tr1
>
> +       movi    datalabel __stack_chk_guard, r0
> +       movi    0x000a0dff, r1
> +       st.l    r0, 0, r1
> +
>         /*
>          * Decompress the kernel.
>          */
> diff --git a/arch/sh/boot/compressed/misc.c b/arch/sh/boot/compressed/misc.c
> index 627ce8e..fe4c079 100644
> --- a/arch/sh/boot/compressed/misc.c
> +++ b/arch/sh/boot/compressed/misc.c
> @@ -106,11 +106,6 @@ static void error(char *x)
>
>  unsigned long __stack_chk_guard;
>
> -void __stack_chk_guard_setup(void)
> -{
> -       __stack_chk_guard = 0x000a0dff;
> -}
> -
>  void __stack_chk_fail(void)
>  {
>         error("stack-protector: Kernel stack is corrupted\n");
> @@ -130,8 +125,6 @@ void decompress_kernel(void)
>  {
>         unsigned long output_addr;
>
> -       __stack_chk_guard_setup();
> -
>  #ifdef CONFIG_SUPERH64
>         output_addr = (CONFIG_MEMORY_START + 0x2000);
>  #else
> --
> 2.7.0
>
--
To unsubscribe from this list: send the line "unsubscribe linux-sh" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 45c8823..bae1fc6 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -547,6 +547,10 @@  not_relocated:	mov	r0, #0
 		bic	r4, r4, #1
 		blne	cache_on
 
+		ldr	r0, =__stack_chk_guard
+		ldr	r1, =0x000a0dff
+		str	r1, [r0]
+
 /*
  * The C runtime environment should now be setup sufficiently.
  * Set up some pointers, and start decompressing.
diff --git a/arch/arm/boot/compressed/misc.c b/arch/arm/boot/compressed/misc.c
index 16a8a80..e518ef5 100644
--- a/arch/arm/boot/compressed/misc.c
+++ b/arch/arm/boot/compressed/misc.c
@@ -130,11 +130,6 @@  asmlinkage void __div0(void)
 
 unsigned long __stack_chk_guard;
 
-void __stack_chk_guard_setup(void)
-{
-	__stack_chk_guard = 0x000a0dff;
-}
-
 void __stack_chk_fail(void)
 {
 	error("stack-protector: Kernel stack is corrupted\n");
@@ -150,8 +145,6 @@  decompress_kernel(unsigned long output_start, unsigned long free_mem_ptr_p,
 {
 	int ret;
 
-	__stack_chk_guard_setup();
-
 	output_data		= (unsigned char *)output_start;
 	free_mem_ptr		= free_mem_ptr_p;
 	free_mem_end_ptr	= free_mem_ptr_end_p;
diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c
index fdf99e9..5ba431c 100644
--- a/arch/mips/boot/compressed/decompress.c
+++ b/arch/mips/boot/compressed/decompress.c
@@ -78,11 +78,6 @@  void error(char *x)
 
 unsigned long __stack_chk_guard;
 
-void __stack_chk_guard_setup(void)
-{
-	__stack_chk_guard = 0x000a0dff;
-}
-
 void __stack_chk_fail(void)
 {
 	error("stack-protector: Kernel stack is corrupted\n");
@@ -92,8 +87,6 @@  void decompress_kernel(unsigned long boot_heap_start)
 {
 	unsigned long zimage_start, zimage_size;
 
-	__stack_chk_guard_setup();
-
 	zimage_start = (unsigned long)(&__image_begin);
 	zimage_size = (unsigned long)(&__image_end) -
 	    (unsigned long)(&__image_begin);
diff --git a/arch/mips/boot/compressed/head.S b/arch/mips/boot/compressed/head.S
index 409cb48..00d0ee0 100644
--- a/arch/mips/boot/compressed/head.S
+++ b/arch/mips/boot/compressed/head.S
@@ -32,6 +32,10 @@  start:
 	bne	a2, a0, 1b
 	 addiu	a0, a0, 4
 
+	PTR_LA	a0, __stack_chk_guard
+	PTR_LI	a1, 0x000a0dff
+	sw	a1, 0(a0)
+
 	PTR_LA	a0, (.heap)	     /* heap address */
 	PTR_LA	sp, (.stack + 8192)  /* stack address */
 
diff --git a/arch/sh/boot/compressed/head_32.S b/arch/sh/boot/compressed/head_32.S
index 7bb1681..a3fdb05 100644
--- a/arch/sh/boot/compressed/head_32.S
+++ b/arch/sh/boot/compressed/head_32.S
@@ -76,6 +76,10 @@  l1:
 	mov.l	init_stack_addr, r0
 	mov.l	@r0, r15
 
+	mov.l	__stack_chk_guard, r0
+	mov	#0x000a0dff, r1
+	mov.l	r1, @r0
+
 	/* Decompress the kernel */
 	mov.l	decompress_kernel_addr, r0
 	jsr	@r0
diff --git a/arch/sh/boot/compressed/head_64.S b/arch/sh/boot/compressed/head_64.S
index 9993113..8b4d540 100644
--- a/arch/sh/boot/compressed/head_64.S
+++ b/arch/sh/boot/compressed/head_64.S
@@ -132,6 +132,10 @@  startup:
 	addi	r22, 4, r22
 	bne	r22, r23, tr1
 
+	movi	datalabel __stack_chk_guard, r0
+	movi	0x000a0dff, r1
+	st.l	r0, 0, r1
+
 	/*
 	 * Decompress the kernel.
 	 */
diff --git a/arch/sh/boot/compressed/misc.c b/arch/sh/boot/compressed/misc.c
index 627ce8e..fe4c079 100644
--- a/arch/sh/boot/compressed/misc.c
+++ b/arch/sh/boot/compressed/misc.c
@@ -106,11 +106,6 @@  static void error(char *x)
 
 unsigned long __stack_chk_guard;
 
-void __stack_chk_guard_setup(void)
-{
-	__stack_chk_guard = 0x000a0dff;
-}
-
 void __stack_chk_fail(void)
 {
 	error("stack-protector: Kernel stack is corrupted\n");
@@ -130,8 +125,6 @@  void decompress_kernel(void)
 {
 	unsigned long output_addr;
 
-	__stack_chk_guard_setup();
-
 #ifdef CONFIG_SUPERH64
 	output_addr = (CONFIG_MEMORY_START + 0x2000);
 #else