From patchwork Fri Mar 16 07:55:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Huacai Chen X-Patchwork-Id: 10286571 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5E3FE60386 for ; Fri, 16 Mar 2018 07:53:25 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5464928C56 for ; Fri, 16 Mar 2018 07:53:25 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 48FAD28DAF; Fri, 16 Mar 2018 07:53:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.6 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, RCVD_IN_SBL, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6ACD328C56 for ; Fri, 16 Mar 2018 07:53:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752550AbeCPHxW (ORCPT ); Fri, 16 Mar 2018 03:53:22 -0400 Received: from mail-pl0-f66.google.com ([209.85.160.66]:33830 "EHLO mail-pl0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752538AbeCPHxV (ORCPT ); Fri, 16 Mar 2018 03:53:21 -0400 Received: by mail-pl0-f66.google.com with SMTP id u11-v6so1794854plq.1; Fri, 16 Mar 2018 00:53:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id; bh=YZECEmSH1FB2QZl184sOHadjXblm6aatIV8GIgxd6jI=; b=VsGB52IVVQcUNTllpzSlCL2HE3PcvmXUawlGyCAEm6DxEnq20ciH/ZEv815drGArjf sqhET/heYK6RVRn9lL2vo6+TGFnxBHMhyv/8oblfFVOTIGGZ4EoEzkl7uIhnw3hvvC8X Rk7rPep/Up0ez5hhj817U7fmTttZ1/AFcP1XX6jBR98+QJB0bdDxOsPOZOuUNRHVV8DJ 1pgEZtGcXwGq2d15rbc9nf6F/sgdn9AQMNlt9TeOkIynF+kJXlWdvKbV7UoZmWivKtVu aIOhi/lE1mRZt2Yewc6A2aT6KJ5FdcgOWBbGB8gfVYZLw6ykmFeQwPo1yejd4OoBWYn2 HenA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id; bh=YZECEmSH1FB2QZl184sOHadjXblm6aatIV8GIgxd6jI=; b=SqQH9Nu+DuLCDtggikc/75KCQYdL2pH+5WL9btR6ADtlpcuiKC8Y67KPBL7m0BzD9/ W7Nf/H8aWmDLP6V0XNZdB8oQi5SQ/98G37Ie/hatwUzoP1mfZcUk/CMyPmYW8G+zYfeA 5pHhH4CSZbCWsLQTfl14UkEsj0UbeltVBtloU2lb03XzPqgcqGPOGz0e4uzNGQ0z8GD6 QsRmS2/RMyVjUdbsKh28jRofYKHkwxpFJKb6fGPYfb7lfG/jqAMDS4FkocpAIFvX5N3m we8/LNy+xF9wd+8iqxynFXDY0uoj2hT0qYx2DymTsKzkSLe26Hjq7VXsxmAMWK36ABLj 0ijg== X-Gm-Message-State: AElRT7GNYiKQKCQKz8hvReRljYbkMWnjGtGbAZK6+xoaxHBA2wbZ0y2u RR32XuVHFoWPflnKqa5PAgA= X-Google-Smtp-Source: AG47ELsKZQLvfvTaqiwZmswd3huEQq9MAXcvrW43tW3ygizmg3l7tdH4l2tjgSeivds154OlKEhryw== X-Received: by 2002:a17:902:9a05:: with SMTP id v5-v6mr1043507plp.69.1521186800938; Fri, 16 Mar 2018 00:53:20 -0700 (PDT) Received: from software.domain.org ([172.247.34.138]) by smtp.gmail.com with ESMTPSA id o5sm14085391pfh.51.2018.03.16.00.53.17 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 16 Mar 2018 00:53:20 -0700 (PDT) From: Huacai Chen To: Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Ralf Baechle , James Hogan , linux-mips@linux-mips.org, Russell King , linux-arm-kernel@lists.infradead.org, Yoshinori Sato , Rich Felker , linux-sh@vger.kernel.org, Huacai Chen , stable@vger.kernel.org Subject: [PATCH V3] ZBOOT: fix stack protector in compressed boot phase Date: Fri, 16 Mar 2018 15:55:16 +0800 Message-Id: <1521186916-13745-1-git-send-email-chenhc@lemote.com> X-Mailer: git-send-email 2.7.0 Sender: linux-sh-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-sh@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Call __stack_chk_guard_setup() in decompress_kernel() is too late that stack checking always fails for decompress_kernel() itself. So remove __stack_chk_guard_setup() and initialize __stack_chk_guard before we call decompress_kernel(). Original code comes from ARM but also used for MIPS and SH, so fix them together. If without this fix, compressed booting of these archs will fail because stack checking is enabled by default (>=4.16). V2: Fix build on ARM. V3: Fix build on SuperH. Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen --- arch/arm/boot/compressed/head.S | 4 ++++ arch/arm/boot/compressed/misc.c | 7 ------- arch/mips/boot/compressed/decompress.c | 7 ------- arch/mips/boot/compressed/head.S | 4 ++++ arch/sh/boot/compressed/head_32.S | 8 ++++++++ arch/sh/boot/compressed/head_64.S | 4 ++++ arch/sh/boot/compressed/misc.c | 7 ------- 7 files changed, 20 insertions(+), 21 deletions(-) diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S index 45c8823..bae1fc6 100644 --- a/arch/arm/boot/compressed/head.S +++ b/arch/arm/boot/compressed/head.S @@ -547,6 +547,10 @@ not_relocated: mov r0, #0 bic r4, r4, #1 blne cache_on + ldr r0, =__stack_chk_guard + ldr r1, =0x000a0dff + str r1, [r0] + /* * The C runtime environment should now be setup sufficiently. * Set up some pointers, and start decompressing. diff --git a/arch/arm/boot/compressed/misc.c b/arch/arm/boot/compressed/misc.c index 16a8a80..e518ef5 100644 --- a/arch/arm/boot/compressed/misc.c +++ b/arch/arm/boot/compressed/misc.c @@ -130,11 +130,6 @@ asmlinkage void __div0(void) unsigned long __stack_chk_guard; -void __stack_chk_guard_setup(void) -{ - __stack_chk_guard = 0x000a0dff; -} - void __stack_chk_fail(void) { error("stack-protector: Kernel stack is corrupted\n"); @@ -150,8 +145,6 @@ decompress_kernel(unsigned long output_start, unsigned long free_mem_ptr_p, { int ret; - __stack_chk_guard_setup(); - output_data = (unsigned char *)output_start; free_mem_ptr = free_mem_ptr_p; free_mem_end_ptr = free_mem_ptr_end_p; diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c index fdf99e9..5ba431c 100644 --- a/arch/mips/boot/compressed/decompress.c +++ b/arch/mips/boot/compressed/decompress.c @@ -78,11 +78,6 @@ void error(char *x) unsigned long __stack_chk_guard; -void __stack_chk_guard_setup(void) -{ - __stack_chk_guard = 0x000a0dff; -} - void __stack_chk_fail(void) { error("stack-protector: Kernel stack is corrupted\n"); @@ -92,8 +87,6 @@ void decompress_kernel(unsigned long boot_heap_start) { unsigned long zimage_start, zimage_size; - __stack_chk_guard_setup(); - zimage_start = (unsigned long)(&__image_begin); zimage_size = (unsigned long)(&__image_end) - (unsigned long)(&__image_begin); diff --git a/arch/mips/boot/compressed/head.S b/arch/mips/boot/compressed/head.S index 409cb48..00d0ee0 100644 --- a/arch/mips/boot/compressed/head.S +++ b/arch/mips/boot/compressed/head.S @@ -32,6 +32,10 @@ start: bne a2, a0, 1b addiu a0, a0, 4 + PTR_LA a0, __stack_chk_guard + PTR_LI a1, 0x000a0dff + sw a1, 0(a0) + PTR_LA a0, (.heap) /* heap address */ PTR_LA sp, (.stack + 8192) /* stack address */ diff --git a/arch/sh/boot/compressed/head_32.S b/arch/sh/boot/compressed/head_32.S index 7bb1681..e84237d 100644 --- a/arch/sh/boot/compressed/head_32.S +++ b/arch/sh/boot/compressed/head_32.S @@ -76,6 +76,10 @@ l1: mov.l init_stack_addr, r0 mov.l @r0, r15 + mov.l __stack_chk_guard_addr, r0 + mov.l __stack_chk_guard_val, r1 + mov.l r1, @r0 + /* Decompress the kernel */ mov.l decompress_kernel_addr, r0 jsr @r0 @@ -97,6 +101,10 @@ kexec_magic: .long 0x400000F0 /* magic used by kexec to parse zImage format */ init_stack_addr: .long stack_start +__stack_chk_guard_val: + .long 0x000A0DFF +__stack_chk_guard_addr: + .long __stack_chk_guard decompress_kernel_addr: .long decompress_kernel kernel_start_addr: diff --git a/arch/sh/boot/compressed/head_64.S b/arch/sh/boot/compressed/head_64.S index 9993113..8b4d540 100644 --- a/arch/sh/boot/compressed/head_64.S +++ b/arch/sh/boot/compressed/head_64.S @@ -132,6 +132,10 @@ startup: addi r22, 4, r22 bne r22, r23, tr1 + movi datalabel __stack_chk_guard, r0 + movi 0x000a0dff, r1 + st.l r0, 0, r1 + /* * Decompress the kernel. */ diff --git a/arch/sh/boot/compressed/misc.c b/arch/sh/boot/compressed/misc.c index 627ce8e..fe4c079 100644 --- a/arch/sh/boot/compressed/misc.c +++ b/arch/sh/boot/compressed/misc.c @@ -106,11 +106,6 @@ static void error(char *x) unsigned long __stack_chk_guard; -void __stack_chk_guard_setup(void) -{ - __stack_chk_guard = 0x000a0dff; -} - void __stack_chk_fail(void) { error("stack-protector: Kernel stack is corrupted\n"); @@ -130,8 +125,6 @@ void decompress_kernel(void) { unsigned long output_addr; - __stack_chk_guard_setup(); - #ifdef CONFIG_SUPERH64 output_addr = (CONFIG_MEMORY_START + 0x2000); #else