From: Petr Mladek <pmladek@suse.com>

Date: Fri, 14 Jul 2017 14:51:13 +0200

Subject: [PATCH] printk/console: Enhance the check for consoles using init

 memory

Git-commit: 5a814231ae3d4f248a8ecb668a072a1da471c656

References: bsc#1063026

Patch-Mainline: v4.14-rc1

printk_late_init() is responsible for disabling boot consoles that

use init memory. It checks the address of struct console for this.

But this is not enough. For example, there are several early

consoles that have write() method in the init section and

struct console in the normal section. They are not disabled

and could cause fancy and hard to debug system states.

It is even more complicated by the macros EARLYCON_DECLARE() and

OF_EARLYCON_DECLARE() where various struct members are set at

runtime by the provided setup() function.

I have tried to reproduce this problem and forced the classic uart

early console to stay using keep_bootcon parameter. In particular

I used earlycon=uart,io,0x3f8 keep_bootcon console=ttyS0,115200.

The system did not boot:

[    1.570496] PM: Image not found (code -22)

[    1.570496] PM: Image not found (code -22)

[    1.571886] PM: Hibernation image not present or could not be loaded.

[    1.571886] PM: Hibernation image not present or could not be loaded.

[    1.576407] Freeing unused kernel memory: 2528K

[    1.577244] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)

The double lines are caused by having both early uart console and

ttyS0 console enabled at the same time. The early console stopped

working when the init memory was freed. Fortunately, the invalid

call was caught by the NX-protexted page check and did not cause

any silent fancy problems.

This patch adds a check for many other addresses stored in

struct console. It omits setup() and match() that are used

only when the console is registered. Therefore they have

already been used at this point and there is no reason

to use them again.

Link: http://lkml.kernel.org/r/1500036673-7122-3-git-send-email-pmladek@suse.com

Cc: Steven Rostedt <rostedt@goodmis.org>

Cc: Andrew Morton <akpm@linux-foundation.org>

Cc: Peter Zijlstra <peterz@infradead.org>

Cc: Matt Redfearn <matt.redfearn@imgtec.com>

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Cc: Jiri Slaby <jslaby@suse.com>

Cc: "David S. Miller" <davem@davemloft.net>

Cc: Alan Cox <gnomes@lxorguk.ukuu.org.uk>

Cc: "Fabio M. Di Nitto" <fdinitto@redhat.com>

Cc: linux-serial@vger.kernel.org

Cc: linux-kernel@vger.kernel.org

Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>

Signed-off-by: Petr Mladek <pmladek@suse.com>

---

 kernel/printk/printk.c | 12 ++++++++++--

 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c

index 76985ee3dfff..87f1a8f4e0f9 100644

--- a/kernel/printk/printk.c

+++ b/kernel/printk/printk.c

@@ -2659,8 +2659,16 @@ static int __init printk_late_init(void)

 	int ret;

 	for_each_console(con) {

-		if ((con->flags & CON_BOOT) &&

-		    init_section_intersects(con, sizeof(*con))) {

+		if (!(con->flags & CON_BOOT))

+			continue;

+

+		/* Check addresses that might be used for enabled consoles. */

+		if (init_section_intersects(con, sizeof(*con)) ||

+		    init_section_contains(con->write, 0) ||

+		    init_section_contains(con->read, 0) ||

+		    init_section_contains(con->device, 0) ||

+		    init_section_contains(con->unblank, 0) ||

+		    init_section_contains(con->data, 0)) {

 			/*

 			 * Please, consider moving the reported consoles out

 			 * of the init section.

-- 

1.8.5.6