Re: [PATCH v3 05/19] x86, boot: Fix run_size calculation

From: Kees Cook
Date: Tue Mar 08 2016 - 13:06:08 EST


On Mon, Mar 7, 2016 at 8:57 PM, Baoquan He <bhe@xxxxxxxxxx> wrote:
> On 03/07/16 at 03:10pm, Kees Cook wrote:
>> On Fri, Mar 4, 2016 at 8:25 AM, Baoquan He <bhe@xxxxxxxxxx> wrote:
>> > From: Yinghai Lu <yinghai@xxxxxxxxxx>
>> >
>> > Firstly, current run_size is calculated via shell script
>> > arch/x86/tools/calc_run_size.sh. It gets file offset and mem size of section
>> > .bss and .brk in vmlinux, then add them as follows:
>> >
>> > run_size=$(( $offsetA + $sizeA + $sizeB ))
>> >
>> > However this is completely wrong. The offset is the starting address of
>> > section or segment in elf file. Below is a vmlinux I compiled:
>> >
>> > [bhe@x1 linux]$ objdump -h vmlinux
>> >
>> > vmlinux: file format elf64-x86-64
>> >
>> > Sections:
>> > Idx Name Size VMA LMA File off Algn
>> > 27 .bss 00170000 ffffffff81ec8000 0000000001ec8000 012c8000 2**12
>> > ALLOC
>> > 28 .brk 00027000 ffffffff82038000 0000000002038000 012c8000 2**0
>> > ALLOC
>> >
>> > Here we can get run_size is 0x145f000.
>> > 0x012c8000+0x012c8000+0x00027000=0x145f000
>>
>> This example calculation looks wrong to me. run_size is offset + size
>> + size (not offset + offset + size):
>>
>> 0x12c8000+0x17000+0x27000 = 0x1306000
>
> Yeah, please forgive my carelessness. I copied the wrong size of .bss.
> But you also typied the wrong value of .bss size, it should be 0x170000.
> So the result is still right.
>
> 0x12c8000+0x170000+0x27000 = 0x145f000

Hah, whoops. Yeah. Math is hard! :)

>> > [bhe@x1 linux]$ readelf -l vmlinux
>> >
>> > Elf file type is EXEC (Executable file)
>> > Entry point 0x1000000
>> > There are 5 program headers, starting at offset 64
>> >
>> > Program Headers:
>> > Type Offset VirtAddr PhysAddr
>> > FileSiz MemSiz Flags Align
>> > LOAD 0x0000000000200000 0xffffffff81000000 0x0000000001000000
>> > 0x0000000000b5e000 0x0000000000b5e000 R E 200000
>> > LOAD 0x0000000000e00000 0xffffffff81c00000 0x0000000001c00000
>> > 0x0000000000145000 0x0000000000145000 RW 200000
>> > LOAD 0x0000000001000000 0x0000000000000000 0x0000000001d45000
>> > 0x0000000000018158 0x0000000000018158 RW 200000
>> > LOAD 0x000000000115e000 0xffffffff81d5e000 0x0000000001d5e000
>> > 0x000000000016a000 0x0000000000301000 RWE 200000
>> > NOTE 0x000000000099bcac 0xffffffff8179bcac 0x000000000179bcac
>> > 0x00000000000001bc 0x00000000000001bc 4
>> >
>> > Section to Segment mapping:
>> > Segment Sections...
>> > 00 .text .notes __ex_table .rodata __bug_table .pci_fixup .tracedata __ksymtab __ksymtab_gpl __ksymtab_strings __init_rodata __param __modver
>> > 01 .data .vvar
>> > 02 .data..percpu
>> > 03 .init.text .init.data .x86_cpu_dev.init .parainstructions .altinstructions .altinstr_replacement .iommu_table .apicdrivers .exit.text .smp_locks .bss .brk
>> > 04 .notes
>> >
>> > Here we can get the same value as current run_size if we add p_offset
>> > and p_memsz.
>> > 0x000000000115e000+0x0000000000301000=0x145f000
>> >
>> > But is it right? Obviously not. We should calculate it using the last LOAD
>> > program segment like this:
>> > run_size = phdr->p_paddr + phdr->p_memsz - physical load addr of kernel
>> > run_size=0x0000000001d5e000+0x0000000000301000-0x0000000001000000=0x105f000
>>
>> Segment 03 ends at 0xffffffff81d5e000 + 0x301000 = 0xffffffff8205f000,
>> which does match where .brk ends (0xffffffff82038000 + 0x27000 =
>> 0xffffffff8205f000).
>
> Ah, yes, exactly. They prove it in different way.

Yeah, I'm satisfied that this change is correct. I just got confused
by the earlier example. :)

>
>>
>> >
>> > It's equal to VO_end-VO_text and certainly it's simpler to do.
>> > _end: 0xffffffff8205f000
>> > _text:0xffffffff81000000
>> > run_size = 0xffffffff8205f000-0xffffffff81000000=0x105f000
>>
>> I would agree, it would seem like the existing run_size calculation is
>> 0x247000 too high in this example.
>
> It should be 0x400000 high as you mistakenly input the size of .bss ^_^.
> 0x145f000 - 0x105f000 = 0x400000
>
> Extra 4M is added in this example.

Right. Thanks!

-Kees


--
Kees Cook
Chrome OS & Brillo Security