From patchwork Wed Oct 13 17:57:39 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12556507 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 06518C4332F for ; Wed, 13 Oct 2021 17:58:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E515160174 for ; Wed, 13 Oct 2021 17:58:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238397AbhJMSAD (ORCPT ); Wed, 13 Oct 2021 14:00:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42610 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238357AbhJMR75 (ORCPT ); Wed, 13 Oct 2021 13:59:57 -0400 Received: from mail-pg1-x52c.google.com (mail-pg1-x52c.google.com [IPv6:2607:f8b0:4864:20::52c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7B01AC061760 for ; Wed, 13 Oct 2021 10:57:53 -0700 (PDT) Received: by mail-pg1-x52c.google.com with SMTP id q5so3069418pgr.7 for ; Wed, 13 Oct 2021 10:57:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=0v5zgaNa83f9AuzQ/blhmCEtXoKIIed9gMaMemt8JlU=; b=VlOOG8DzVhr/2BK75cck54oQ8iA+zN/CTP+1r0Io184jYHAR7/YgN6/7eY+it2pUVJ eZEIJE8R4ec+S1ppElq+hhEdzoj9equrNraxuudXL+qJFgSGxS8lLckg4Y48gJRU3B5Y mD2/csF8XEaxpc0tVhjYCct5QZv9bkjG5DW7A= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=0v5zgaNa83f9AuzQ/blhmCEtXoKIIed9gMaMemt8JlU=; b=g+eGsqR0gHkAlsDxJNLCgFRV1han4wK1vTsddgA50TxGzZbxpsCenoW7Dc6gB75hYd IGf+kncnQRm9T1EAQF3SWJBJ0NS4voYOk5G7Uoq4OMtIiNn0cAwQKw3Co5dBV6nbkUkN k0WDCxCJL01THJ6RhUv5bJUDCOpkaAUi3WgoOjzXYHj+sMhQux4mcU9gdmtXgE/qMzDy Jm5HMnC3l3rm6SsPGtoymNvQbS6p4Y05CHq+kOdpaqqdd69TVWxDUYh3+mGrl9COapBJ pDG+x8qvkcow61fWins5vDYYQ4uG2xCrk+7yF13bTjG3ROVA+JRMby0qDbGWbit2h+/D mELw== X-Gm-Message-State: AOAM5338rfCGHDOAy3+ICLVd/78U6kMt0rUfOQb7R/sOZ0s0IjFwRxAY a/wZkc42TAoA/KlqROxSSNVBsw== X-Google-Smtp-Source: ABdhPJw004U6L0D+18VMWEbk6cdAUXpiATvAxyqBQ5pBK7yOvWvr8jvwE6iWRj65Hb/v6NdTOzvd+A== X-Received: by 2002:aa7:9ec6:0:b0:44d:6650:c1ff with SMTP id r6-20020aa79ec6000000b0044d6650c1ffmr430977pfq.15.1634147872953; Wed, 13 Oct 2021 10:57:52 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id c8sm171783pgn.72.2021.10.13.10.57.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 Oct 2021 10:57:52 -0700 (PDT) From: Kees Cook To: Borislav Petkov Cc: Kees Cook , Kristen Carlson Accardi , Tony Luck , "H . Peter Anvin" , Alexander Lobakin , Josh Poimboeuf , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Arnd Bergmann , Joerg Roedel , Arvind Sankar , Jing Yangyang , Abaci Robot , Jiapeng Chong , Nathan Chancellor , Nick Desaulniers , Vincenzo Frascino , Andrey Konovalov , Miroslav Benes , "H. Nikolaus Schaller" , Fangrui Song , linux-kernel@vger.kernel.org, x86@kernel.org, linux-arch@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 1/4] x86/tools/relocs: Support >64K section headers Date: Wed, 13 Oct 2021 10:57:39 -0700 Message-Id: <20211013175742.1197608-2-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211013175742.1197608-1-keescook@chromium.org> References: <20211013175742.1197608-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5891; i=keescook@chromium.org; h=from:subject; bh=0cl+0Q9TemQRuQNHUlHXCWH24NyrqX+rsH/tprTSAfM=; b=owEBbAKT/ZANAwAKAYly9N/cbcAmAcsmYgBhZx4VX84HrL/hk4UwuTN9MqL5dCY9q+zsf5xeCNOf py+mN1KJAjIEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYWceFQAKCRCJcvTf3G3AJjsuD/ ioh8hRwFLYDNKhSJXklcSdmFbPWb/fL/vJZmbrOlTTndRbKIggguRR3NdVdz/gXZ7ZxopnxE0goAqv xn5APnzQrHZb8FLDBmYP34IgnN3/shqNo4mWMllAemPw8E7SPBNJ6wFnWhkTBmEpIdSN4sxnQjtpKb xopgHurwMp7Ajrb9g+/7hEK4+qhz2K+zW3nV3u2yxwmxT5iXtldI9KZ1eIDae7Ty2Na3wWCF8UlmvR 8kkDqQRyIRE3n52GcpEr7FnmBRX0DGvwzw4WhXs1dFSr9DRA3SAT3dJnp0aER2XQzYGtqfPBap0UCg G215RJVlwicFdavCR2ah5RUuRJc+pxnr787+tZ0To9y+1lOqToGTO8Cu5VO48GAfzrM9OG9SrOFQAU W0FyN6HPv+VoaOANDZde/BieolBvj0K+q8THRm232TlBLaCknsZWE/W71+Ff+0CoxfH2zURQVd5RJ/ zXE/tJpuosIvt2/2QJz1iPNm692DWmONLD0l2n1iCPQ1jG96NXq5Mx3WxUglDnt0ALmW4OPqlD96R1 oxIjSNWQWQz/yBbhItconRS3l3Qk25ZsHbNfedf1+fHzIzMMDdT6zZwO8M1LNK/xTUtthr8LmMMp1W lFq1nkk8yxtkYIFFI+MAgar5prIP70n+vNUS9O8jJfV8qJWa0FgCW+ttSr X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org From: Kristen Carlson Accardi While the relocs tool already supports finding the total number of section headers if vmlinux exceeds 64K sections, it fails to read the extended symbol table to get section header indexes for symbols, causing incorrect symbol table indexes to be used when there are > 64K symbols. Parse the ELF file to read the extended symbol table info, and then replace all direct references to st_shndx with calls to sym_index(), which will determine whether the value can be read directly or whether the value should be pulled out of the extended table. This is needed for future FGKASLR support, which uses a separate section per function. Signed-off-by: Kristen Carlson Accardi Reviewed-by: Kees Cook Reviewed-by: Tony Luck Tested-by: Tony Luck Acked-by: H. Peter Anvin (Intel) Signed-off-by: Alexander Lobakin Signed-off-by: Kees Cook --- arch/x86/tools/relocs.c | 103 ++++++++++++++++++++++++++++++---------- 1 file changed, 78 insertions(+), 25 deletions(-) diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c index 27c82207d387..3f5d39768287 100644 --- a/arch/x86/tools/relocs.c +++ b/arch/x86/tools/relocs.c @@ -14,6 +14,10 @@ static Elf_Ehdr ehdr; static unsigned long shnum; static unsigned int shstrndx; +static unsigned int shsymtabndx; +static unsigned int shxsymtabndx; + +static int sym_index(Elf_Sym *sym); struct relocs { uint32_t *offset; @@ -35,6 +39,7 @@ struct section { Elf_Shdr shdr; struct section *link; Elf_Sym *symtab; + Elf32_Word *xsymtab; Elf_Rel *reltab; char *strtab; }; @@ -268,7 +273,7 @@ static const char *sym_name(const char *sym_strtab, Elf_Sym *sym) name = sym_strtab + sym->st_name; } else { - name = sec_name(sym->st_shndx); + name = sec_name(sym_index(sym)); } return name; } @@ -338,6 +343,23 @@ static uint64_t elf64_to_cpu(uint64_t val) #define elf_xword_to_cpu(x) elf32_to_cpu(x) #endif +static int sym_index(Elf_Sym *sym) +{ + Elf_Sym *symtab = secs[shsymtabndx].symtab; + Elf32_Word *xsymtab = secs[shxsymtabndx].xsymtab; + unsigned long offset; + int index; + + if (sym->st_shndx != SHN_XINDEX) + return sym->st_shndx; + + /* calculate offset of sym from head of table. */ + offset = (unsigned long)sym - (unsigned long)symtab; + index = offset / sizeof(*sym); + + return elf32_to_cpu(xsymtab[index]); +} + static void read_ehdr(FILE *fp) { if (fread(&ehdr, sizeof(ehdr), 1, fp) != 1) { @@ -471,31 +493,60 @@ static void read_strtabs(FILE *fp) static void read_symtabs(FILE *fp) { int i,j; + for (i = 0; i < shnum; i++) { struct section *sec = &secs[i]; - if (sec->shdr.sh_type != SHT_SYMTAB) { + int num_syms; + + switch (sec->shdr.sh_type) { + case SHT_SYMTAB_SHNDX: + sec->xsymtab = malloc(sec->shdr.sh_size); + if (!sec->xsymtab) { + die("malloc of %" FMT " bytes for xsymtab failed\n", + sec->shdr.sh_size); + } + if (fseek(fp, sec->shdr.sh_offset, SEEK_SET) < 0) { + die("Seek to %" FMT " failed: %s\n", + sec->shdr.sh_offset, strerror(errno)); + } + if (fread(sec->xsymtab, 1, sec->shdr.sh_size, fp) + != sec->shdr.sh_size) { + die("Cannot read extended symbol table: %s\n", + strerror(errno)); + } + shxsymtabndx = i; + continue; + + case SHT_SYMTAB: + num_syms = sec->shdr.sh_size / sizeof(Elf_Sym); + + sec->symtab = malloc(sec->shdr.sh_size); + if (!sec->symtab) { + die("malloc of %" FMT " bytes for symtab failed\n", + sec->shdr.sh_size); + } + if (fseek(fp, sec->shdr.sh_offset, SEEK_SET) < 0) { + die("Seek to %" FMT " failed: %s\n", + sec->shdr.sh_offset, strerror(errno)); + } + if (fread(sec->symtab, 1, sec->shdr.sh_size, fp) + != sec->shdr.sh_size) { + die("Cannot read symbol table: %s\n", + strerror(errno)); + } + for (j = 0; j < num_syms; j++) { + Elf_Sym *sym = &sec->symtab[j]; + + sym->st_name = elf_word_to_cpu(sym->st_name); + sym->st_value = elf_addr_to_cpu(sym->st_value); + sym->st_size = elf_xword_to_cpu(sym->st_size); + sym->st_shndx = elf_half_to_cpu(sym->st_shndx); + } + shsymtabndx = i; + continue; + + default: continue; - } - sec->symtab = malloc(sec->shdr.sh_size); - if (!sec->symtab) { - die("malloc of %" FMT " bytes for symtab failed\n", - sec->shdr.sh_size); - } - if (fseek(fp, sec->shdr.sh_offset, SEEK_SET) < 0) { - die("Seek to %" FMT " failed: %s\n", - sec->shdr.sh_offset, strerror(errno)); - } - if (fread(sec->symtab, 1, sec->shdr.sh_size, fp) - != sec->shdr.sh_size) { - die("Cannot read symbol table: %s\n", - strerror(errno)); - } - for (j = 0; j < sec->shdr.sh_size/sizeof(Elf_Sym); j++) { - Elf_Sym *sym = &sec->symtab[j]; - sym->st_name = elf_word_to_cpu(sym->st_name); - sym->st_value = elf_addr_to_cpu(sym->st_value); - sym->st_size = elf_xword_to_cpu(sym->st_size); - sym->st_shndx = elf_half_to_cpu(sym->st_shndx); } } } @@ -762,7 +813,9 @@ static void percpu_init(void) */ static int is_percpu_sym(ElfW(Sym) *sym, const char *symname) { - return (sym->st_shndx == per_cpu_shndx) && + int shndx = sym_index(sym); + + return (shndx == per_cpu_shndx) && strcmp(symname, "__init_begin") && strcmp(symname, "__per_cpu_load") && strncmp(symname, "init_per_cpu_", 13); @@ -1095,7 +1148,7 @@ static int do_reloc_info(struct section *sec, Elf_Rel *rel, ElfW(Sym) *sym, sec_name(sec->shdr.sh_info), rel_type(ELF_R_TYPE(rel->r_info)), symname, - sec_name(sym->st_shndx)); + sec_name(sym_index(sym))); return 0; } From patchwork Wed Oct 13 17:57:40 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12556505 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BDDC0C4332F for ; Wed, 13 Oct 2021 17:58:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A3FD960174 for ; Wed, 13 Oct 2021 17:58:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238389AbhJMSAA (ORCPT ); Wed, 13 Oct 2021 14:00:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42626 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238351AbhJMR75 (ORCPT ); Wed, 13 Oct 2021 13:59:57 -0400 Received: from mail-pg1-x534.google.com (mail-pg1-x534.google.com [IPv6:2607:f8b0:4864:20::534]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 55477C061768 for ; Wed, 13 Oct 2021 10:57:53 -0700 (PDT) Received: by mail-pg1-x534.google.com with SMTP id f5so3052285pgc.12 for ; Wed, 13 Oct 2021 10:57:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Rp/JVQM4Zv+z3R4Pp047EZ8OQIJJhiuVH2ShyShd8FQ=; b=AGf5J4fnB0CIf5oxKxNnebjHnga1X27gio9TLxKDp4cDcoEwjJkAv0RTYHBrcorpdn SDIGdpyqqgIZhXiJZTCki+bz8p6xidCP/Hiysv2vJB9Nael8hi4PJ5xzrSnIVLjQWXII 4tUmK26ouXhNJAnDDBCpgiRcfyPY8NmpLk3RU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Rp/JVQM4Zv+z3R4Pp047EZ8OQIJJhiuVH2ShyShd8FQ=; b=4xZdpZNccnHVVavV/o6ZCQyNkrb2g/iDFruBu1M7ozPGHJ1YUGgtUzXWOp4t9i1pYl N5Uk1TRwI2CrGCJYa3r5c4QWMHsZoohV+0CdhL0fR8+daP/Crrqx3CUzvi3MiFEf1eKL bVJKy0AH0r4X5mYgWYAcf9EjnJ5U64p0OXWSHeLjVQTr5Clh0C5YvRpnw0f9RnhPbQg/ l4Sx+Ey7FIFfvWbnq6DKjoTG3AEr7jciltPiP84Wf3tBzsSalhQDmeWv26EL0BZVLxN2 K4qKOLjX+p5kNgMRqe4JDAbEunhISziooVOe3msE6F8YeAWWSrqqT3Dwhvdkb2VYOjwW fcXQ== X-Gm-Message-State: AOAM53025asphjLEDV6I17BFT3in8GztMoJBWOlBlnhlsO/BmQ2uVUqu l6DDTiXm71d5eZTI8Gr8ANHFEg== X-Google-Smtp-Source: ABdhPJzzqggQEfz5rWpsNrPSPD8dksHrIMYyrtHC5TUFXM/iotEJD9Nvzsjyf2oRj3qDSc5gKHiYFQ== X-Received: by 2002:a63:e10d:: with SMTP id z13mr442755pgh.375.1634147872778; Wed, 13 Oct 2021 10:57:52 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id i15sm184365pfq.21.2021.10.13.10.57.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 Oct 2021 10:57:52 -0700 (PDT) From: Kees Cook To: Borislav Petkov Cc: Kees Cook , Josh Poimboeuf , "H. Peter Anvin" , Kristen Carlson Accardi , Tony Luck , Alexander Lobakin , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Arnd Bergmann , Joerg Roedel , Arvind Sankar , Jing Yangyang , Abaci Robot , Jiapeng Chong , Nathan Chancellor , Nick Desaulniers , Vincenzo Frascino , Andrey Konovalov , Miroslav Benes , "H. Nikolaus Schaller" , Fangrui Song , linux-kernel@vger.kernel.org, x86@kernel.org, linux-arch@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 2/4] x86/boot: Allow a "silent" kaslr random byte fetch Date: Wed, 13 Oct 2021 10:57:40 -0700 Message-Id: <20211013175742.1197608-3-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211013175742.1197608-1-keescook@chromium.org> References: <20211013175742.1197608-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1845; h=from:subject; bh=QYsHdjNAtpfLq0fC/fv08OJWSBanqdK3WCZTPqw/9/s=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBhZx4V4ONsRXTnUoTv5VE1BbZVcnOmEFIIPdvBhYBT k3QraSKJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYWceFQAKCRCJcvTf3G3AJpVREA CkYyOkUtZaF+Mud9ViQGaUPLcCI1HQbGZwtEHWyhrvXtV6LhGtQllhonYGicjqofzZPd6VFr3wpfP6 4B4EpTlXgvkr83DGSN0Lh2/z3O2QIrDsz3zXQYwMVVAqWY+9BVuNUgFtpiHrKODBFfcRHVAtCH3Msu hwLWa+7A3XxKUWbpLw2pmyIydVpuPAFZW2JZ/5tZDxhG6UjKgw+hu99phR8lL6cx4PlTt4+Mp1W18g JJfAkLhKJdvmOSAMUIZWqnnw+iM6+9/bVdFzCEJcMHnFsATRc1yVv2IaTkZpVXMLV96PAdgGny4zBk oX6IBB6UB9aj60WoVaONIxaM+ebV2o6HfE5UFP7DmBHA6IPMVUpfK9F5kUWvkKrH71FPqoOwJuc6jH l2Lu8GguqnBYXTRPPTJgOAxt3AahlwxlNlBs6TSRYc6RBGirisMTtlsZjdtbkL2vEnDd2QW6q0O2W+ L75t7fTCJq5Px5dBCU8MDIvhC4MwHyMy3t45oivfYs+4oIPeguiVsxV66z6vS4MryzM+JHT53eZ498 STKepS+eXsnCSzBbZUrxsvbe4Z8kpDR1EI+uII91hWxJxT98GqYesqXbWrevxmMMv7zoS3WsAi3MMG tkQBpRDL7CXB0eol2vprTxzr7eI9rZsWDpskFepd9u98TYVSYf0HFRHyonkA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Under earlyprintk, each RNG call produces a debug report line. To support the future FGKASLR feature, which will fetch random bytes during function shuffling, this is not useful information (each line is identical and tells us nothing new), needlessly spamming the console. Instead, allow for a NULL "purpose" to suppress the debug reporting. Signed-off-by: Kees Cook Reviewed-by: Nick Desaulniers --- arch/x86/lib/kaslr.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/arch/x86/lib/kaslr.c b/arch/x86/lib/kaslr.c index a53665116458..2b3eb8c948a3 100644 --- a/arch/x86/lib/kaslr.c +++ b/arch/x86/lib/kaslr.c @@ -56,11 +56,14 @@ unsigned long kaslr_get_random_long(const char *purpose) unsigned long raw, random = get_boot_seed(); bool use_i8254 = true; - debug_putstr(purpose); - debug_putstr(" KASLR using"); + if (purpose) { + debug_putstr(purpose); + debug_putstr(" KASLR using"); + } if (has_cpuflag(X86_FEATURE_RDRAND)) { - debug_putstr(" RDRAND"); + if (purpose) + debug_putstr(" RDRAND"); if (rdrand_long(&raw)) { random ^= raw; use_i8254 = false; @@ -68,7 +71,8 @@ unsigned long kaslr_get_random_long(const char *purpose) } if (has_cpuflag(X86_FEATURE_TSC)) { - debug_putstr(" RDTSC"); + if (purpose) + debug_putstr(" RDTSC"); raw = rdtsc(); random ^= raw; @@ -76,7 +80,8 @@ unsigned long kaslr_get_random_long(const char *purpose) } if (use_i8254) { - debug_putstr(" i8254"); + if (purpose) + debug_putstr(" i8254"); random ^= i8254(); } @@ -86,7 +91,8 @@ unsigned long kaslr_get_random_long(const char *purpose) : "a" (random), "rm" (mix_const)); random += raw; - debug_putstr("...\n"); + if (purpose) + debug_putstr("...\n"); return random; } From patchwork Wed Oct 13 17:57:41 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12556503 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC502C433EF for ; Wed, 13 Oct 2021 17:57:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 986A060174 for ; Wed, 13 Oct 2021 17:57:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238329AbhJMR77 (ORCPT ); Wed, 13 Oct 2021 13:59:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42612 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238310AbhJMR75 (ORCPT ); Wed, 13 Oct 2021 13:59:57 -0400 Received: from mail-pf1-x429.google.com (mail-pf1-x429.google.com [IPv6:2607:f8b0:4864:20::429]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A2CBC061746 for ; Wed, 13 Oct 2021 10:57:53 -0700 (PDT) Received: by mail-pf1-x429.google.com with SMTP id y7so3165521pfg.8 for ; Wed, 13 Oct 2021 10:57:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Kcjz/jZcxE+mB3F2AkM0clWB2nKEsktmPdDaqY7pNLM=; b=L75cOX6+P2Yg2PCtJBc3rDxsjCw7N/NVtlafkSSqqUGzYVqCBBPEt9zMKsJ+BBeqTQ XSfl2ZFSn+uvEQ2K00+x27I4dsgfBWLotrBBXGLMS7tKuUf8Tj6WaQSomgkFtKyLA4W2 lCeFO9tpk6CbOVBc2TLZDwUMCfoxm5xa5u7L0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Kcjz/jZcxE+mB3F2AkM0clWB2nKEsktmPdDaqY7pNLM=; b=Lo+Frj9CYGXpMDGKgZIvlMDOT188LzsfJSw7JDR4eiMZ+IoqaQPaZYsRLUr4bp9C+L HEEQxjon1iy12cDIIuATPVvqEfj8Y98AxYoNHXSUhONJOYJ/s5rJhx9kiQYaoxeMSr4t 9/1hQHhkggh9RWp+lUQLMD69Ur0Qs0UD3iqIa31cPFkWKesHVpfJIjIsPO3XqHrq0Lhp OToI2aY36VRpRtK3V193eOFlnI6diR7JE/32yIxSxHPZoYWuLGivdW2XWv0nShP6zmRq oPIDa3Uuf0N9eooyuWOI7M8qSUUqCotcWNjiJ1gp+TYmhjTQciwMaRII05Nj5NjuCHRh pMWA== X-Gm-Message-State: AOAM530JEQQ1mabSzaIT9a3GybCdsu++iu8QvhXu2oZhBdhjhBBFazLY dRltkzrxbcWc8oe20I/u80U1tg== X-Google-Smtp-Source: ABdhPJx3hCeP0/qXzBriQG9RAyOIBhOSahtHSc2nigzi8GBlJyOW45fh2MS5OSF1B4QStfEMj11pPA== X-Received: by 2002:a63:2acc:: with SMTP id q195mr450989pgq.45.1634147872623; Wed, 13 Oct 2021 10:57:52 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id d9sm162132pgn.64.2021.10.13.10.57.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 Oct 2021 10:57:52 -0700 (PDT) From: Kees Cook To: Borislav Petkov Cc: Kees Cook , Alexander Lobakin , Josh Poimboeuf , "H. Peter Anvin" , Kristen Carlson Accardi , Tony Luck , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Arnd Bergmann , Joerg Roedel , Arvind Sankar , Jing Yangyang , Abaci Robot , Jiapeng Chong , Nathan Chancellor , Nick Desaulniers , Vincenzo Frascino , Andrey Konovalov , Miroslav Benes , "H. Nikolaus Schaller" , Fangrui Song , linux-kernel@vger.kernel.org, x86@kernel.org, linux-arch@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 3/4] x86/boot/compressed: Avoid duplicate malloc() implementations Date: Wed, 13 Oct 2021 10:57:41 -0700 Message-Id: <20211013175742.1197608-4-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211013175742.1197608-1-keescook@chromium.org> References: <20211013175742.1197608-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4454; h=from:subject; bh=hYF77CNx8NXydRq0Sh94JwlUksK5cSbvI41FvGg5UbQ=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBhZx4VrL7HD4WV4zwnJZdT6sN2jDPwltje0/KQButA e0RjcEKJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYWceFQAKCRCJcvTf3G3AJjoGD/ sGuSJ5GjwOngN6Kzcn20C3dlHYxuKIeUYkhzF7JVQ1n9+cPfhqDVzDkbO+NJHYfvK7zrlGgsa6wtI2 fi7EeRT/FVXdNE356vGVAKnwm8+JqAf8+fMAZCnQAtpMjwF6Wgs9uBhPvRxnKb2AKTXjWqEiwhfTBS QabEnkh5Xo6Dy2QFIJVGPob91BrYShwcIClCE2qTZiAIGbKxS4ia3bHtBPTDXVLNgutIo9Lemw9Htd 70YgUsSCEj0YBclhomTZ4ZMh/hN6yNgXDVo8vnUGrLqtWKsrqAec1NSe11qDqnG2ih+vcoYkivRemG c6TCd9u6BDGU8EIATYPTf577U7csmm4Mdfi29fsUhG58Fg0z9Os2/cZd4LKvAJFZmDmyIQvrnw9Ymt jHGrMQz2/qdikk4WfndV7Pw+tJ7c68L2hHXynezzXebe1LdW2fcuVaeeME1cyF0kjZ9x1lIBw3MBEv Q+OqsZCZ0mSjrL2zFAovH6+vnhA5M1wv34ML2bYsgn/kDHg7SgmIEfzCvi/0p4rk9guAkF+VSMhNQn s/AEh3Knh2JP4VvkKq4gR1of3+iCI8cr5aPhhwppSOvqqJdjozgCHojH4ZZG/m1yiprZBQBWEDVT1n Ax/1g3/3igDo4LbXRABYBefMmZOEFhGay99YNxHgk0tkgX2EXq8bucbu/1Hg== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org The early malloc() and free() implementation in include/linux/decompress/mm.h (which is also included by the static decompressors) is static. This is fine when the only thing interested in using malloc() is the decompression code, but the x86 early boot environment may use malloc() in a couple places, leading to a potential collision when the static copies of the available memory region ("malloc_ptr") gets reset to the global "free_mem_ptr" value. As it happened, the existing usage pattern was accidentally safe because each user did 1 malloc() and 1 free() before returning and were not nested: extract_kernel() (misc.c) choose_random_location() (kaslr.c) mem_avoid_init() handle_mem_options() malloc() ... free() ... parse_elf() (misc.c) malloc() ... free() Once the future FGKASLR series is added, however, it will insert additional malloc() calls local to fgkaslr.c in the middle of parse_elf()'s malloc()/free() pair: parse_elf() (misc.c) malloc() if (...) { layout_randomized_image(output, &ehdr, phdrs); malloc() <- boom ... else layout_image(output, &ehdr, phdrs); free() To avoid collisions, there must be a single implementation of malloc(). Adjust include/linux/decompress/mm.h so that visibility can be controlled, provide prototypes in misc.h, and implement the functions in misc.c. This also results in a small size savings: $ size vmlinux.before vmlinux.after text data bss dec hex filename 8842314 468 178320 9021102 89a6ae vmlinux.before 8842240 468 178320 9021028 89a664 vmlinux.after Fixed-by: Alexander Lobakin Signed-off-by: Kees Cook --- arch/x86/boot/compressed/kaslr.c | 4 ---- arch/x86/boot/compressed/misc.c | 3 +++ arch/x86/boot/compressed/misc.h | 2 ++ include/linux/decompress/mm.h | 12 ++++++++++-- 4 files changed, 15 insertions(+), 6 deletions(-) diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c index 67c3208b668a..411b268bc0a2 100644 --- a/arch/x86/boot/compressed/kaslr.c +++ b/arch/x86/boot/compressed/kaslr.c @@ -32,10 +32,6 @@ #include #include -/* Macros used by the included decompressor code below. */ -#define STATIC -#include - #define _SETUP #include /* For COMMAND_LINE_SIZE */ #undef _SETUP diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c index 743f13ea25c1..a4339cb2d247 100644 --- a/arch/x86/boot/compressed/misc.c +++ b/arch/x86/boot/compressed/misc.c @@ -28,6 +28,9 @@ /* Macros used by the included decompressor code below. */ #define STATIC static +/* Define an externally visible malloc()/free(). */ +#define MALLOC_VISIBLE +#include /* * Provide definitions of memzero and memmove as some of the decompressors will diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h index 31139256859f..975ef4ae7395 100644 --- a/arch/x86/boot/compressed/misc.h +++ b/arch/x86/boot/compressed/misc.h @@ -44,6 +44,8 @@ extern char _head[], _end[]; /* misc.c */ extern memptr free_mem_ptr; extern memptr free_mem_end_ptr; +void *malloc(int size); +void free(void *where); extern struct boot_params *boot_params; void __putstr(const char *s); void __puthex(unsigned long value); diff --git a/include/linux/decompress/mm.h b/include/linux/decompress/mm.h index 868e9eacd69e..9192986b1a73 100644 --- a/include/linux/decompress/mm.h +++ b/include/linux/decompress/mm.h @@ -25,13 +25,21 @@ #define STATIC_RW_DATA static #endif +/* + * When an architecture needs to share the malloc()/free() implementation + * between compilation units, it needs to have non-local visibility. + */ +#ifndef MALLOC_VISIBLE +#define MALLOC_VISIBLE static +#endif + /* A trivial malloc implementation, adapted from * malloc by Hannu Savolainen 1993 and Matthias Urlichs 1994 */ STATIC_RW_DATA unsigned long malloc_ptr; STATIC_RW_DATA int malloc_count; -static void *malloc(int size) +MALLOC_VISIBLE void *malloc(int size) { void *p; @@ -52,7 +60,7 @@ static void *malloc(int size) return p; } -static void free(void *where) +MALLOC_VISIBLE void free(void *where) { malloc_count--; if (!malloc_count) From patchwork Wed Oct 13 17:57:42 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12556509 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6248CC433FE for ; Wed, 13 Oct 2021 17:58:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4B41C60E0C for ; Wed, 13 Oct 2021 17:58:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238365AbhJMSAH (ORCPT ); Wed, 13 Oct 2021 14:00:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42630 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238371AbhJMR76 (ORCPT ); Wed, 13 Oct 2021 13:59:58 -0400 Received: from mail-pj1-x1032.google.com (mail-pj1-x1032.google.com [IPv6:2607:f8b0:4864:20::1032]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E2A41C06176A for ; Wed, 13 Oct 2021 10:57:53 -0700 (PDT) Received: by mail-pj1-x1032.google.com with SMTP id oa4so2853867pjb.2 for ; Wed, 13 Oct 2021 10:57:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Wil/63TXmGDXk8caQMGWTopKyQa13eqS6eC+7karBaE=; b=VZ4nrKIZEK1VybcI8FUe8isxzKX4Ld95xUW5bYpz4w9tM0KJD65DFFtnfXHg2TwCKh BSgOYOh/4sFeW21L2nDMi05diDrAY9bYzujsdWGACTFL3Im10dOCEZiiKvJ+xSSiIUWR v8vX1ZIJvu0XaWLCYRpRl3Fcrt/nvFH9hFgZg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Wil/63TXmGDXk8caQMGWTopKyQa13eqS6eC+7karBaE=; b=ovbgLCsMPf74otLJRG8eorxZ8WzqMJsaQTZyaehiCeDh3BngKMmRFpsbGh4X0Lwcw6 GQm275MgrweH5UsaWgvKWM8uLNnjOkVlSfhBtpMA5NkGURDKgF6NetQD8IUt0YizwDO5 u+vdO1OFppYAj8TYOvVnHfIVrBYNLNBnZykucT16orYWtomH/5Fvjjj13jpZDdDgSKwj eHLZffI0G7RW0pnmO4Mys+pRclGr1thfR995zlCotFIP+m+0eXzMVgT8ripqaS7qfQ4b vONo10utwlE2g6Z6VYRLXtWUZzdXjHgaAlpS1iiAQ0q+O1/DQE/X7fT5NtI9YN65yWX7 pxwg== X-Gm-Message-State: AOAM531EA4stlVszXllv2BrmEMyWjPMhgkkmKMjc+BWB5TbbMRkp2OXA MgE0praYZ2VoP2VYN+4wTt53qg== X-Google-Smtp-Source: ABdhPJyswszq3QTxMPcFY4OXzvodtOaRNJnZsNbbx4wT72YhrF8zSP+mvkenSQMQ5T9gqtN5mHsrGA== X-Received: by 2002:a17:90a:708c:: with SMTP id g12mr14898831pjk.13.1634147873464; Wed, 13 Oct 2021 10:57:53 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id y17sm152997pfi.206.2021.10.13.10.57.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 Oct 2021 10:57:52 -0700 (PDT) From: Kees Cook To: Borislav Petkov Cc: Kees Cook , Kristen Carlson Accardi , Tony Luck , Alexander Lobakin , Josh Poimboeuf , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Arnd Bergmann , Joerg Roedel , Arvind Sankar , Jing Yangyang , Abaci Robot , Jiapeng Chong , Nathan Chancellor , Nick Desaulniers , Vincenzo Frascino , Andrey Konovalov , Miroslav Benes , "H. Nikolaus Schaller" , Fangrui Song , linux-kernel@vger.kernel.org, x86@kernel.org, linux-arch@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH 4/4] vmlinux.lds.h: Have ORC lookup cover entire _etext - _stext Date: Wed, 13 Oct 2021 10:57:42 -0700 Message-Id: <20211013175742.1197608-5-keescook@chromium.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211013175742.1197608-1-keescook@chromium.org> References: <20211013175742.1197608-1-keescook@chromium.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1515; i=keescook@chromium.org; h=from:subject; bh=k2EbSSyIQX82JiiaJvqlP/RcdDJ2EE1Zagzi5pGa5w4=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBhZx4V/q7Qtv5z3EdcaNERESTHxHiSwOuLyfKGJP66 I1Sp0GeJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCYWceFQAKCRCJcvTf3G3AJtMAEA CnRbxwLq4djag3FKjOJqXVG93SIBjMFoOP2r6FQKFmg+Sx+La42TmYXQfl+Y06uyzGPXzn7lcPTd3t pRS8Nd3mtup03MwELRe6hepMKBzwbcD0DSL3fndhNAwHi+SAK7TbPDOTSMktICkLwNxdxceTeddsTt /w5ooHDAqXGXij9kSQBuseSSUkUH6YfKAvh0Uhqw1Y7md8TgXSOQI1n5t6QcZIX1kPwY4exf2sF169 Pv8rwaPg6oJId6/sMD5Xd3zPuJiUT8Id+EhXiuHAh6j3TSZ/U2uJkBhpGoR+bVvOnAO8CkqyT8BSIf Jt9PSr72bX6gWiIIKzcUYSYN+WXQubCAO/xfE+KFnc1Al4IXgSydyQrKaWIptFb5MJJasBLUrvBvTv 5RzNH+pVCKeuwVw6cHcQyjp7zj+MQ3sP0lkVhO/RsDlVAoBdUCBvLuWkhU4RCIxVJqsBtYP9NbGO8B a+BdIC7FEAcehRluS64ab6KeoTTiFKSHftDHrKVUPdpvpBetoajc/Z59dZbygKvUF5c+SbrdR9IPhu w/kglfkq/QK/hAbQlufGfiqb9ademjXAqKzsDG8fp4eiMndvw/DTr/VJofRwVnsE+1IeEP2wzQ5QbT 6HBmO1LZToqH6fQT/9RLKxqVs/6ObcOHgnhAxVxI3mz5PDRVmd325GFaAX2g== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org From: Kristen Carlson Accardi When using -ffunction-sections to place each function in its own text section (so it can be randomized at load time in the future FGKASLR series), the linker will place most of the functions into separate .text.* sections. SIZEOF(.text) won't work here for calculating the ORC lookup table size, so the total text size must be calculated to include .text AND all .text.* sections. Signed-off-by: Kristen Carlson Accardi Reviewed-by: Tony Luck Tested-by: Tony Luck Reviewed-by: Kees Cook [ alobakin: move it to vmlinux.lds.h and make arch-indep ] Signed-off-by: Alexander Lobakin Signed-off-by: Kees Cook Acked-by: Josh Poimboeuf --- include/asm-generic/vmlinux.lds.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h index f2984af2b85b..e8234911dc18 100644 --- a/include/asm-generic/vmlinux.lds.h +++ b/include/asm-generic/vmlinux.lds.h @@ -869,10 +869,11 @@ KEEP(*(.orc_unwind)) \ __stop_orc_unwind = .; \ } \ + text_size = _etext - _stext; \ . = ALIGN(4); \ .orc_lookup : AT(ADDR(.orc_lookup) - LOAD_OFFSET) { \ orc_lookup = .; \ - . += (((SIZEOF(.text) + LOOKUP_BLOCK_SIZE - 1) / \ + . += (((text_size + LOOKUP_BLOCK_SIZE - 1) / \ LOOKUP_BLOCK_SIZE) + 1) * 4; \ orc_lookup_end = .; \ }