Skip to content
  • Baoquan He's avatar
    x86/KASLR: Fix kexec kernel boot crash when KASLR randomization fails · da63b6b2
    Baoquan He authored
    
    
    Dave found that a kdump kernel with KASLR enabled will reset to the BIOS
    immediately if physical randomization failed to find a new position for
    the kernel. A kernel with the 'nokaslr' option works in this case.
    
    The reason is that KASLR will install a new page table for the identity
    mapping, while it missed building it for the original kernel location
    if KASLR physical randomization fails.
    
    This only happens in the kexec/kdump kernel, because the identity mapping
    has been built for kexec/kdump in the 1st kernel for the whole memory by
    calling init_pgtable(). Here if physical randomizaiton fails, it won't build
    the identity mapping for the original area of the kernel but change to a
    new page table '_pgtable'. Then the kernel will triple fault immediately
    caused by no identity mappings.
    
    The normal kernel won't see this bug, because it comes here via startup_32()
    and CR3 will be set to _pgtable already. In startup_32() the identity
    mapping is built for the 0~4G area. In KASLR we just append to the existing
    area instead of entirely overwriting it for on-demand identity mapping
    building. So the identity mapping for the original area of kernel is still
    there.
    
    To fix it we just switch to the new identity mapping page table when physical
    KASLR succeeds. Otherwise we keep the old page table unchanged just like
    "nokaslr" does.
    
    Signed-off-by: default avatarBaoquan He <bhe@redhat.com>
    Signed-off-by: default avatarDave Young <dyoung@redhat.com>
    Acked-by: default avatarKees Cook <keescook@chromium.org>
    Cc: Borislav Petkov <bp@suse.de>
    Cc: Dave Jiang <dave.jiang@intel.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Garnier <thgarnie@google.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Yinghai Lu <yinghai@kernel.org>
    Link: http://lkml.kernel.org/r/1493278940-5885-1-git-send-email-bhe@redhat.com
    
    
    Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
    da63b6b2