x86/KASLR: Allow randomization below the load address

Currently the kernel image physical address randomization's lower
boundary is the original kernel load address.

For bootloaders that load kernels into very high memory (e.g. kexec),
this means randomization takes place in a very small window at the
top of memory, ignoring the large region of physical memory below
the load address.

Since mem_avoid[] is already correctly tracking the regions that must be
avoided, this patch changes the minimum address to whatever is less:
512M (to conservatively avoid unknown things in lower memory) or the
load address. Now, for example, if the kernel is loaded at 8G, [512M,
8G) will be added to the list of possible physical memory positions.

Signed-off-by: Yinghai Lu <yinghai@kernel.org>
[ Rewrote the changelog, refactored the code to use min(). ]
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Baoquan He <bhe@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: H.J. Lu <hjl.tools@gmail.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1464216334-17200-6-git-send-email-keescook@chromium.org
[ Edited the changelog some more, plus the code comment as well. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>

diff --git a/arch/x86/boot/compressed/kaslr.c b/arch/x86/boot/compressed/kaslr.c
index 36e28112523adb60facd4a974f366d06e494f904..749c9e00c67405157a85ed9052a2f10c03194ff2 100644 (file)
--- a/arch/x86/boot/compressed/kaslr.c
+++ b/arch/x86/boot/compressed/kaslr.c
@@ -492,7 +492,7 @@ void choose_random_location(unsigned long input,
                            unsigned long output_size,
                            unsigned long *virt_addr)
 {
-       unsigned long random_addr;
+       unsigned long random_addr, min_addr;
 
        /* By default, keep output position unchanged. */
        *virt_addr = *output;
@@ -510,8 +510,15 @@ void choose_random_location(unsigned long input,
        /* Record the various known unsafe memory ranges. */
        mem_avoid_init(input, input_size, *output);
 
+       /*
+        * Low end of the randomization range should be the
+        * smaller of 512M or the initial kernel image
+        * location:
+        */
+       min_addr = min(*output, 512UL << 20);
+
        /* Walk e820 and find a random address. */
-       random_addr = find_random_phys_addr(*output, output_size);
+       random_addr = find_random_phys_addr(min_addr, output_size);
        if (!random_addr) {
                warn("KASLR disabled: could not find suitable E820 region!");
        } else {