x86/boot/KASLR: Code bug fix about kernel virtual address randomization

People complained that crashkernel high doesn't work when kaslr code compiled in but add 'nokaslr' to diable it. Kexec has the same phenomenon.

The root cause is a code bug which assigned the original loading address of kernel to the local variable 'virt_addr' which represents the offset of kernel virtual address randmoization. As we know, kernel can be loaded to anywhere under 64T physically, this wrong assignment could cause kernel relocation handling of x86 64 error if no kaslr is taken.

The v1 post can be found here:
x86/boot/KASLR: Skip relocation handling in no kaslr case
https://patchwork.kernel.org/patch/9807789/

In v2, Ingo suggested that we should add a judgement to check if 'virt_addr' is randomized to make kernel beyond the kernel mapping area. This checking can let us know the error but not reset to firmware quietly as it does now.

Baoquan He (2):
x86/boot/KASLR: Add checking for the offset of kernel virtual address
randomization
x86/boot/KASLR: Fix the wrong assignment to 'virt_addr'

 arch/x86/boot/compressed/kaslr.c | 3 ---
 arch/x86/boot/compressed/misc.c  | 6 ++++--
 arch/x86/boot/compressed/misc.h  | 2 --
 3 files changed, 4 insertions(+), 7 deletions(-)

2.5.5

For kernel text KASLR, the virtual address is confined to area of 1G, [0xffffffff80000000, 0xffffffffc0000000). For the implemenataion of virtual address randomization, we only randomize to get an offset between 16M and 1G, then add this offset to the starting address, 0xffffffff80000000. Here 16M is the offset which is decided at linking stage. So the amount of the local variable 'virt_addr' which respresents the offset plus the kernel output size can not exceed KERNEL_IMAGE_SIZE.

Add a judgement to check the offset. If out of bounds, print error message and hang there.

---
 arch/x86/boot/compressed/misc.c | 2 ++
 1 file changed, 2 insertions(+)

index b3c5a5f030ce..6008fa9b74d9 100644
@@ -390,6 +390,8 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap,
 #ifdef CONFIG_X86_64
 	if (heap > 0x3fffffffffffUL)
 		error("Destination address too large");
+	if (virt_addr + max(output_len, kernel_total_size) > KERNEL_IMAGE_SIZE)
+		error("Destination virtual address is beyond the kernel mapping area");
 #else
 	if (heap > ((-__PAGE_OFFSET-(128<<20)-1) & 0x7fffffff))
 		error("Destination address too large");

2.5.5

Kernel text KASLR is separated into physical address and virtual address randomization. And for virtual address randomization, we only randomiza to get an offset between 16M and KERNEL_IMAGE_SIZE. So the initial value of 'virt_addr' should be LOAD_PHYSICAL_ADDR, but not the original kernel loading address 'output'. It's a code bug.

The bug will cause kernel failure if kernel is loaded at a different position than the address, 16M, which is decided at compiled time. Kexec/kdump is such pratical case.

To fix it, just assign LOAD_PHYSICAL_ADDR to virt_addr as initial value.

---
 arch/x86/boot/compressed/kaslr.c | 3 ---
 arch/x86/boot/compressed/misc.c  | 4 ++--
 arch/x86/boot/compressed/misc.h  | 2 --
 3 files changed, 2 insertions(+), 7 deletions(-)

index fe318b44f7b8..91f27ab970ef 100644
@@ -625,9 +625,6 @@ void choose_random_location(unsigned long input,
 {
 	unsigned long random_addr, min_addr;
 
-	/* By default, keep output position unchanged. */
-	*virt_addr = *output;
-
 	if (cmdline_find_option_bool("nokaslr")) {
 		warn("KASLR disabled: 'nokaslr' on cmdline.");
 		return;

index 6008fa9b74d9..00241c815524 100644
@@ -338,7 +338,7 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap,
 				  unsigned long output_len)
 {
 	const unsigned long kernel_total_size = VO__end - VO__text;
-	unsigned long virt_addr = (unsigned long)output;
+	unsigned long virt_addr = LOAD_PHYSICAL_ADDR;
 
 	/* Retain x86 boot parameters pointer passed from startup_32/64. */
 	boot_params = rmode;

@@ -399,7 +399,7 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap,
 #ifndef CONFIG_RELOCATABLE
 	if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
 		error("Destination address does not match LOAD_PHYSICAL_ADDR");
-	if ((unsigned long)output != virt_addr)
+	if (virt_addr != LOAD_PHYSICAL_ADDR)
 		error("Destination virtual address changed when not relocatable");
 #endif
 

index 1c8355eadbd1..766a5211f827 100644
@@ -81,8 +81,6 @@ static inline void choose_random_location(unsigned long input,
 					  unsigned long output_size,
 					  unsigned long *virt_addr)
 {
-	/* No change from existing output location. */
-	*virt_addr = *output;
 }
 #endif
 

2.5.5

This is a regression, with 4.12* kernel kexec reboot fails always on my desktop pc now without kaslr being enabled.