From patchwork Mon Oct 10 16:00:16 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Roger_Pau_Monn=C3=A9?= X-Patchwork-Id: 9369689 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0C7636048F for ; Mon, 10 Oct 2016 16:03:15 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ED60E28EE1 for ; Mon, 10 Oct 2016 16:03:14 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E1F712930E; Mon, 10 Oct 2016 16:03:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id ECB4828EE1 for ; Mon, 10 Oct 2016 16:03:12 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1btd0M-0005mG-4D; Mon, 10 Oct 2016 16:00:42 +0000 Received: from mail6.bemta6.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1btd0K-0005m5-D2 for xen-devel@lists.xenproject.org; Mon, 10 Oct 2016 16:00:40 +0000 Received: from [193.109.254.147] by server-9.bemta-6.messagelabs.com id 78/52-28857-72BBBF75; Mon, 10 Oct 2016 16:00:39 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprLIsWRWlGSWpSXmKPExsWyU9JRQld99+9 wg6e7GC2+b5nM5MDocfjDFZYAxijWzLyk/IoE1ozzp1axF/QrVZzoPcHcwPhesouRk0NCwE+i f+dRNhCbTUBH4uLcnUA2B4eIgIrE7b0GXYxcHMwCE5klnv65ClYjLOAvsXzGNWYQm0VAVWLlh 5tMIDavgLPEvI6dbBAzdSUenvvNChEXlDg58wkLiM0soCnRuv03O4QtL9G8dTbYHCEBRYn+eQ +getMlJj7rYYGwuSVWfv7DMoGRbxaSUbOQjJqFZNQCRuZVjBrFqUVlqUW6RqZ6SUWZ6RkluYm ZObqGBmZ6uanFxYnpqTmJScV6yfm5mxiBwcYABDsYVy0IPMQoycGkJMrbv+l3uBBfUn5KZUZi cUZ8UWlOavEhRhkODiUJ3js7gHKCRanpqRVpmTnAsIdJS3DwKInw5u4ESvMWFyTmFmemQ6ROM SpKifN+AekTAElklObBtcFi7RKjrJQwLyPQIUI8BalFuZklqPKvGMU5GJWEedNAxvNk5pXATX 8FtJgJaDHL4h8gi0sSEVJSDYypMW8CLrFL5d0/b7zMd6L5NuXPzHHaUatCvSPVw/Yrr9v956M UhxL3op/zJnw+vP+v59k/7yUvr1k8abPV+RVc0yP7HfZ+nyxUbnee5Yj69HXHJrY+UNXesPdY 6ZG5ly1yT51a/fIO1wmbzN7b195PYVkxM9VKqT434unRv9w/HA8cao1cGrygT4mlOCPRUIu5q DgRAIqlH2qwAgAA X-Env-Sender: prvs=084f71764=roger.pau@citrix.com X-Msg-Ref: server-7.tower-27.messagelabs.com!1476115238!59829678!1 X-Originating-IP: [185.25.65.24] X-SpamReason: No, hits=0.0 required=7.0 tests=received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 8.84; banners=-,-,- X-VirusChecked: Checked Received: (qmail 22738 invoked from network); 10 Oct 2016 16:00:38 -0000 Received: from smtp.ctxuk.citrix.com (HELO SMTP.EU.CITRIX.COM) (185.25.65.24) by server-7.tower-27.messagelabs.com with RC4-SHA encrypted SMTP; 10 Oct 2016 16:00:38 -0000 X-IronPort-AV: E=Sophos;i="5.31,325,1473120000"; d="scan'208";a="32784443" From: Roger Pau Monne To: Date: Mon, 10 Oct 2016 17:00:16 +0100 Message-ID: <1476115216-1082-1-git-send-email-roger.pau@citrix.com> X-Mailer: git-send-email 2.7.4 (Apple Git-66) MIME-Version: 1.0 X-ClientProxiedBy: AMSPEX02CAS02.citrite.net (10.69.22.113) To AMSPEX02CL02.citrite.net (10.69.22.126) X-DLP: AMS1 Cc: Stefano Stabellini , Wei Liu , George Dunlap , Andrew Cooper , Brian Marcotte , Ian Jackson , Tim Deegan , Jan Beulich , Roger Pau Monne Subject: [Xen-devel] [PATCH v2 for-4.8] libelf: fix symtab/strtab loading for 32bit domains X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Commit ed04ca introduced a bug in the symtab/strtab loading for 32bit guests, that corrupted the section headers array due to the padding introduced by the elf_shdr union. The Elf section header array on 32bit should be accessible as an array of Elf32_Shdr elements, and the union with Elf64_Shdr done in elf_shdr was breaking this due to size differences between Elf32_Shdr and Elf64_Shdr. Fix this by copying each section header one by one, and using the proper size depending on the bitness of the guest kernel. While there, also fix elf_parse_bsdsyms so that it takes into account the size of the elf_ehdr struct instead of the native Elf header size. Reported-by: Brian Marcotte Signed-off-by: Roger Pau Monné Acked-by: Ian Jackson --- Cc: Brian Marcotte Cc: Andrew Cooper Cc: George Dunlap Cc: Ian Jackson Cc: Jan Beulich Cc: Konrad Rzeszutek Wilk Cc: Stefano Stabellini Cc: Tim Deegan Cc: Wei Liu --- Should be backported to Xen 4.7 stable branch. --- Changes since v1: - No need to calculate shdr_size again, it's already fetched from the original elf header. - Remove shdr variable. - Use offsetof instead of subtracting two sizeofs. - Fix elf_parse_bsdsyms so that it takes into account the size of elf_ehdr instead of the size of the native elf header. --- xen/common/libelf/libelf-loader.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-) diff --git a/xen/common/libelf/libelf-loader.c b/xen/common/libelf/libelf-loader.c index 2626a40..47699ec 100644 --- a/xen/common/libelf/libelf-loader.c +++ b/xen/common/libelf/libelf-loader.c @@ -174,8 +174,8 @@ void elf_parse_bsdsyms(struct elf_binary *elf, uint64_t pstart) /* Space to store the size of the elf image */ sz = sizeof(uint32_t); - /* Space for the elf and elf section headers */ - sz += elf_uval(elf, elf->ehdr, e_ehsize) + + /* Space for the elf header and elf section headers */ + sz += sizeof(elf_ehdr) + ELF_BSDSYM_SECTIONS * elf_uval(elf, elf->ehdr, e_shentsize); sz = elf_round_up(elf, sz); @@ -258,13 +258,13 @@ static void elf_load_bsdsyms(struct elf_binary *elf) struct { elf_ehdr header; elf_shdr section[ELF_BSDSYM_SECTIONS]; - } __attribute__((packed)) elf_header; + } elf_header; } __attribute__((packed)) header; ELF_HANDLE_DECL(elf_ehdr) header_handle; - unsigned long shdr_size; + unsigned long shdr_size, ehdr_size; ELF_HANDLE_DECL(elf_shdr) section_handle; - unsigned int link, rc; + unsigned int link, rc, i; elf_ptrval header_base; elf_ptrval elf_header_base; elf_ptrval symtab_base; @@ -394,15 +394,35 @@ do { \ header.size = strtab_base + elf_uval(elf, section_handle, sh_size) - elf_header_base; - /* Load the headers. */ + /* Load the size plus elf header. */ + ehdr_size = offsetof(typeof(header), elf_header.section); rc = elf_load_image(elf, header_base, ELF_REALPTR2PTRVAL(&header), - sizeof(header), sizeof(header)); + ehdr_size, ehdr_size); if ( rc != 0 ) { elf_mark_broken(elf, "unable to load ELF headers into guest memory"); return; } + /* + * Load the section headers. + * + * NB: this _must_ be done one by one, and taking the bitness into account, + * so that the guest can treat this as an array of type Elf{32/64}_Shdr. + */ + for ( i = 0; i < ELF_BSDSYM_SECTIONS; i++ ) + { + rc = elf_load_image(elf, header_base + ehdr_size + shdr_size * i, + ELF_REALPTR2PTRVAL(&header.elf_header.section[i]), + shdr_size, shdr_size); + if ( rc != 0 ) + { + elf_mark_broken(elf, + "unable to load ELF section header into guest memory"); + return; + } + } + /* Remove permissions from elf_memcpy_safe. */ elf->caller_xdest_base = NULL; elf->caller_xdest_size = 0;