16ce62a20SAndrew GeisslerFrom d48ec5e1a5fb7907520dee71b1d94045486a0c29 Mon Sep 17 00:00:00 2001 26ce62a20SAndrew GeisslerFrom: Alexander Kamensky <alexander.kamensky42@gmail.com> 36ce62a20SAndrew GeisslerDate: Thu, 12 Nov 2020 12:56:46 -0800 46ce62a20SAndrew GeisslerSubject: [PATCH] arm64: kexec: disabled check if kaslr-seed dtb property was 56ce62a20SAndrew Geissler wiped 66ce62a20SAndrew Geissler 76ce62a20SAndrew GeisslerKexec when loading arm64 kernel checks if chosen/kaslr-seed dtb property is 86ce62a20SAndrew Geisslerwiped. It's a good assertion to verify proper behavior of kernel. However, 96ce62a20SAndrew Geisslerif bootloader creates and fills kaslr-seed property and kernel is not 106ce62a20SAndrew Geisslerconfigured with CONFIG_RANDOMIZE_BASE then logic of reading and wiping 116ce62a20SAndrew Geisslerkaslr-seed does not run. As a result kaslr-seed property is not zero and when 126ce62a20SAndrew Geisslerkexec tries to load secondary kernel it fails with the following message: 136ce62a20SAndrew Geissler 146ce62a20SAndrew Geisslersetup_2nd_dtb: kaslr-seed is not wiped to 0. 156ce62a20SAndrew Geisslerkexec: setup_2nd_dtb failed. 166ce62a20SAndrew Geisslerkexec: load failed. 176ce62a20SAndrew Geissler 186ce62a20SAndrew GeisslerThis was observed on Yocto Project on qemuarm64 machine with 5.8 kernel, 196ce62a20SAndrew Geisslerqemu 5.1.0. Qemu created kaslr-seed property but kernel was not configured 206ce62a20SAndrew Geisslerwith CONFIG_RANDOMIZE_BASE. 216ce62a20SAndrew Geissler 226ce62a20SAndrew GeisslerAlthough check has some value, there is a use-case where it breaks kexec, 236ce62a20SAndrew Geisslerthis patch removes it. 246ce62a20SAndrew Geissler 256ce62a20SAndrew GeisslerNote in described use-case the fact that kaslr-seed is not wiped and user 266ce62a20SAndrew Geisslerreadable through /sys/firmware/fdt or 276ce62a20SAndrew Geissler/sys/firmware/devicetree/base/chosen/kaslr-seed is not a security problem 286ce62a20SAndrew Geissleras kaslr is disabled anyway. 296ce62a20SAndrew Geissler 306ce62a20SAndrew GeisslerSigned-off-by: Alexander Kamensky <alexander.kamensky42@gmail.com> 316ce62a20SAndrew GeisslerUpstream-Status: Submitted [http://lists.infradead.org/pipermail/kexec/2020-November/021740.html] 326ce62a20SAndrew Geissler--- 336ce62a20SAndrew Geissler kexec/arch/arm64/kexec-arm64.c | 14 +------------- 346ce62a20SAndrew Geissler 1 file changed, 1 insertion(+), 13 deletions(-) 356ce62a20SAndrew Geissler 36*03907ee1SPatrick Williamsdiff --git a/kexec/arch/arm64/kexec-arm64.c b/kexec/arch/arm64/kexec-arm64.c 37*03907ee1SPatrick Williamsindex ec6df4b..10238d9 100644 38*03907ee1SPatrick Williams--- a/kexec/arch/arm64/kexec-arm64.c 39*03907ee1SPatrick Williams+++ b/kexec/arch/arm64/kexec-arm64.c 40*03907ee1SPatrick Williams@@ -503,7 +503,7 @@ static int setup_2nd_dtb(struct dtb *dtb, char *command_line, int on_crash) 416ce62a20SAndrew Geissler int len, range_len; 426ce62a20SAndrew Geissler int nodeoffset; 436ce62a20SAndrew Geissler int new_size; 44*03907ee1SPatrick Williams- int i, result, kaslr_seed; 45*03907ee1SPatrick Williams+ int i, result; 466ce62a20SAndrew Geissler 476ce62a20SAndrew Geissler result = fdt_check_header(dtb->buf); 486ce62a20SAndrew Geissler 49*03907ee1SPatrick Williams@@ -576,18 +576,6 @@ static int setup_2nd_dtb(struct dtb *dtb, char *command_line, int on_crash) 506ce62a20SAndrew Geissler return result; 516ce62a20SAndrew Geissler } 526ce62a20SAndrew Geissler } else { 536ce62a20SAndrew Geissler- kaslr_seed = fdt64_to_cpu(*prop); 546ce62a20SAndrew Geissler- 556ce62a20SAndrew Geissler- /* kaslr_seed must be wiped clean by primary 566ce62a20SAndrew Geissler- * kernel during boot 576ce62a20SAndrew Geissler- */ 586ce62a20SAndrew Geissler- if (kaslr_seed != 0) { 596ce62a20SAndrew Geissler- dbgprintf("%s: kaslr-seed is not wiped to 0.\n", 606ce62a20SAndrew Geissler- __func__); 616ce62a20SAndrew Geissler- result = -EINVAL; 626ce62a20SAndrew Geissler- goto on_error; 636ce62a20SAndrew Geissler- } 646ce62a20SAndrew Geissler- 656ce62a20SAndrew Geissler /* 666ce62a20SAndrew Geissler * Invoke the getrandom system call with 676ce62a20SAndrew Geissler * GRND_NONBLOCK, to make sure we 68*03907ee1SPatrick Williams-- 69*03907ee1SPatrick Williams2.25.1 70*03907ee1SPatrick Williams 71