From patchwork Thu Oct 13 12:48:23 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Roger Pau Monne X-Patchwork-Id: 9374937 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0A6FD6075E for ; Thu, 13 Oct 2016 12:50:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EBBB628591 for ; Thu, 13 Oct 2016 12:50:39 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DABEB28546; Thu, 13 Oct 2016 12:50:39 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 702BC2A03D for ; Thu, 13 Oct 2016 12:50:38 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bufR5-0005CD-R0; Thu, 13 Oct 2016 12:48:35 +0000 Received: from mail6.bemta6.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bufR4-0005Bu-Db for xen-devel@lists.xenproject.org; Thu, 13 Oct 2016 12:48:34 +0000 Received: from [85.158.143.35] by server-9.bemta-6.messagelabs.com id 44/0A-28857-0A28FF75; Thu, 13 Oct 2016 12:48:32 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprLIsWRWlGSWpSXmKPExsWyU9JRQndB0/9 wgzkPmS2+b5nM5MDocfjDFZYAxijWzLyk/IoE1oxn+9cwF7TqVnR2H2BqYHyl1MXIySEh4Ccx f0E/K4jNJqAjcXHuTrYuRg4OEQEVidt7DboYuTiYBSYySzz9c5UNpEZYwF/id+dhRhCbRUBV4 tnFFrBeXgFniY9T5jFBzNSVeHjuN1RcUOLkzCcsIDazgKZE6/bf7BC2vETz1tnMILaQgKJE/7 wHbBC96RJb//5ihrC5JVZ+/sMygZFvFpJRs5CMmoVk1AJG5lWMGsWpRWWpRbrGxnpJRZnpGSW 5iZk5uoYGZnq5qcXFiempOYlJxXrJ+bmbGIHBxgAEOxh3rg88xCjJwaQkyvvL73+4EF9Sfkpl RmJxRnxRaU5q8SFGGQ4OJQnexEagnGBRanpqRVpmDjDsYdISHDxKIrxzQNK8xQWJucWZ6RCpU 4yKUuK8PxqAEgIgiYzSPLg2WKxdYpSVEuZlBDpEiKcgtSg3swRV/hWjOAejkjAvL8h4nsy8Er jpr4AWMwEttpn0B2RxSSJCSqqB8ebbA8mclYXWE8w2dXyNODX9x6Mldtud42UWZVw1LWx5EfO npHzRpP6T7Kb3DVdoX7P2Ng9VtVGcYv4v0lj68AZT1UcCG84aXhfesejfO9lZRnE1PTc3NH/M 4DwUPLPKVKBTdME2l0SJJ/HnvDSdXkyMOXLCZn+owaY/ck/P+hf7ifHZ9cs9VWIpzkg01GIuK k4EAPLmaSGwAgAA X-Env-Sender: prvs=0871769b0=roger.pau@citrix.com X-Msg-Ref: server-16.tower-21.messagelabs.com!1476362911!33447992!1 X-Originating-IP: [185.25.65.24] X-SpamReason: No, hits=0.0 required=7.0 tests=received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 9.0.13; banners=-,-,- X-VirusChecked: Checked Received: (qmail 31952 invoked from network); 13 Oct 2016 12:48:32 -0000 Received: from smtp.eu.citrix.com (HELO SMTP.EU.CITRIX.COM) (185.25.65.24) by server-16.tower-21.messagelabs.com with RC4-SHA encrypted SMTP; 13 Oct 2016 12:48:32 -0000 X-IronPort-AV: E=Sophos;i="5.31,339,1473120000"; d="scan'208";a="32983436" From: Roger Pau Monne To: Date: Thu, 13 Oct 2016 13:48:23 +0100 Message-ID: <1476362903-8795-1-git-send-email-roger.pau@citrix.com> X-Mailer: git-send-email 2.7.4 (Apple Git-66) MIME-Version: 1.0 X-ClientProxiedBy: AMSPEX02CAS01.citrite.net (10.69.22.112) To AMSPEX02CL02.citrite.net (10.69.22.126) X-DLP: AMS1 Cc: Stefano Stabellini , Wei Liu , George Dunlap , Andrew Cooper , Brian Marcotte , Ian Jackson , Tim Deegan , Jan Beulich , Roger Pau Monne Subject: [Xen-devel] [PATCH v3 for-4.8] libelf: fix symtab/strtab loading for 32bit domains X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Commit ed04ca introduced a bug in the symtab/strtab loading for 32bit guests, that corrupted the section headers array due to the padding introduced by the elf_shdr union. The Elf section header array on 32bit should be accessible as an array of Elf32_Shdr elements, and the union with Elf64_Shdr done in elf_shdr was breaking this due to size differences between Elf32_Shdr and Elf64_Shdr. Fix this by copying each section header one by one, and using the proper size depending on the bitness of the guest kernel. While there, also fix elf_parse_bsdsyms so that it takes into account the size of the elf_ehdr struct instead of the native Elf header size. Reported-by: Brian Marcotte Signed-off-by: Roger Pau Monné Acked-by: Ian Jackson --- Cc: Brian Marcotte Cc: Andrew Cooper Cc: George Dunlap Cc: Ian Jackson Cc: Jan Beulich Cc: Konrad Rzeszutek Wilk Cc: Stefano Stabellini Cc: Tim Deegan Cc: Wei Liu --- Should be backported to Xen 4.7 stable branch. --- Changes since v2: - Use offsetof to correctly account for the memory used by the elf header. Changes since v1: - No need to calculate shdr_size again, it's already fetched from the original elf header. - Remove shdr variable. - Use offsetof instead of subtracting two sizeofs. - Fix elf_parse_bsdsyms so that it takes into account the size of elf_ehdr instead of the size of the native elf header. --- xen/common/libelf/libelf-loader.c | 44 ++++++++++++++++++++++++--------------- xen/include/xen/libelf.h | 10 +++++++++ 2 files changed, 37 insertions(+), 17 deletions(-) diff --git a/xen/common/libelf/libelf-loader.c b/xen/common/libelf/libelf-loader.c index 2626a40..3a83d61 100644 --- a/xen/common/libelf/libelf-loader.c +++ b/xen/common/libelf/libelf-loader.c @@ -21,9 +21,6 @@ #include "libelf-private.h" -/* Number of section header needed in order to fit the SYMTAB and STRTAB. */ -#define ELF_BSDSYM_SECTIONS 3 - /* ------------------------------------------------------------------------ */ elf_errorstatus elf_init(struct elf_binary *elf, const char *image_input, size_t size) @@ -174,8 +171,8 @@ void elf_parse_bsdsyms(struct elf_binary *elf, uint64_t pstart) /* Space to store the size of the elf image */ sz = sizeof(uint32_t); - /* Space for the elf and elf section headers */ - sz += elf_uval(elf, elf->ehdr, e_ehsize) + + /* Space for the elf header and elf section headers */ + sz += offsetof(struct elf_sym_header, elf_header.section) + ELF_BSDSYM_SECTIONS * elf_uval(elf, elf->ehdr, e_shentsize); sz = elf_round_up(elf, sz); @@ -253,18 +250,11 @@ static void elf_load_bsdsyms(struct elf_binary *elf) * strtab, so we only need three section headers in our fake ELF * header (first section header is always the undefined section). */ - struct { - uint32_t size; - struct { - elf_ehdr header; - elf_shdr section[ELF_BSDSYM_SECTIONS]; - } __attribute__((packed)) elf_header; - } __attribute__((packed)) header; - + struct elf_sym_header header; ELF_HANDLE_DECL(elf_ehdr) header_handle; - unsigned long shdr_size; + unsigned long shdr_size, ehdr_size; ELF_HANDLE_DECL(elf_shdr) section_handle; - unsigned int link, rc; + unsigned int link, rc, i; elf_ptrval header_base; elf_ptrval elf_header_base; elf_ptrval symtab_base; @@ -394,15 +384,35 @@ do { \ header.size = strtab_base + elf_uval(elf, section_handle, sh_size) - elf_header_base; - /* Load the headers. */ + /* Load the size plus elf header. */ + ehdr_size = offsetof(typeof(header), elf_header.section); rc = elf_load_image(elf, header_base, ELF_REALPTR2PTRVAL(&header), - sizeof(header), sizeof(header)); + ehdr_size, ehdr_size); if ( rc != 0 ) { elf_mark_broken(elf, "unable to load ELF headers into guest memory"); return; } + /* + * Load the section headers. + * + * NB: this _must_ be done one by one, and taking the bitness into account, + * so that the guest can treat this as an array of type Elf{32/64}_Shdr. + */ + for ( i = 0; i < ELF_BSDSYM_SECTIONS; i++ ) + { + rc = elf_load_image(elf, header_base + ehdr_size + shdr_size * i, + ELF_REALPTR2PTRVAL(&header.elf_header.section[i]), + shdr_size, shdr_size); + if ( rc != 0 ) + { + elf_mark_broken(elf, + "unable to load ELF section header into guest memory"); + return; + } + } + /* Remove permissions from elf_memcpy_safe. */ elf->caller_xdest_base = NULL; elf->caller_xdest_size = 0; diff --git a/xen/include/xen/libelf.h b/xen/include/xen/libelf.h index 90bd8cb..70abbaf 100644 --- a/xen/include/xen/libelf.h +++ b/xen/include/xen/libelf.h @@ -432,6 +432,16 @@ struct elf_dom_parms { uint64_t virt_kend; }; +/* Number of section header needed in order to fit the SYMTAB and STRTAB. */ +#define ELF_BSDSYM_SECTIONS 3 +struct elf_sym_header { + uint32_t size; + struct { + elf_ehdr header; + elf_shdr section[ELF_BSDSYM_SECTIONS]; + } elf_header; +} __attribute__((packed)); + static inline void elf_xen_feature_set(int nr, uint32_t * addr) { addr[nr >> 5] |= 1 << (nr & 31);