Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8da0b724 authored by Philipp Rudo's avatar Philipp Rudo Committed by Linus Torvalds
Browse files

kernel/kexec_file.c: remove mis-use of sh_offset field during purgatory load 

The current code uses the sh_offset field in purgatory_info->sechdrs to
store a pointer to the current load address of the section.  Depending
whether the section will be loaded or not this is either a pointer into
purgatory_info->purgatory_buf or kexec_purgatory.  This is not only a
violation of the ELF standard but also makes the code very hard to
understand as you cannot tell if the memory you are using is read-only
or not.

Remove this misuse and store the offset of the section in
pugaroty_info->purgatory_buf in sh_offset.

Link: http://lkml.kernel.org/r/20180321112751.22196-10-prudo@linux.vnet.ibm.com


Signed-off-by: default avatarPhilipp Rudo <prudo@linux.vnet.ibm.com>
Acked-by: default avatarDave Young <dyoung@redhat.com>
Cc: AKASHI Takahiro <takahiro.akashi@linaro.org>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 620f697c

arch/x86/kernel/machine_kexec_64.c

+6 −4
Original line number Diff line number Diff line
@@ -417,13 +417,15 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi, 
		 * rel[i].r_offset contains byte offset from beginning

		 * of section to the storage unit affected.

		 *

		 * This is location to update (->sh_offset). This is temporary

		 * buffer where section is currently loaded. This will finally

		 * be loaded to a different address later, pointed to by

		 * This is location to update. This is temporary buffer

		 * where section is currently loaded. This will finally be

		 * loaded to a different address later, pointed to by

		 * ->sh_addr. kexec takes care of moving it

		 *  (kexec_load_segment()).

		 */

		location = (void *)(section->sh_offset + rel[i].r_offset);

		location = pi->purgatory_buf;

		location += section->sh_offset;

		location += rel[i].r_offset;



		/* Final address of the location */

		address = section->sh_addr + rel[i].r_offset;

kernel/kexec_file.c

+7 −30
Original line number Diff line number Diff line
@@ -790,6 +790,10 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi, 
	Elf_Shdr *sechdrs;

	int i;



	/*

	 * The section headers in kexec_purgatory are read-only. In order to

	 * have them modifiable make a temporary copy.

	 */

	sechdrs = vzalloc(pi->ehdr->e_shnum * sizeof(Elf_Shdr));

	if (!sechdrs)

		return -ENOMEM;
@@ -797,28 +801,6 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi, 
	       pi->ehdr->e_shnum * sizeof(Elf_Shdr));

	pi->sechdrs = sechdrs;



	/*

	 * We seem to have multiple copies of sections. First copy is which

	 * is embedded in kernel in read only section. Some of these sections

	 * will be copied to a temporary buffer and relocated. And these

	 * sections will finally be copied to their final destination at

	 * segment load time.

	 *

	 * Use ->sh_offset to reflect section address in memory. It will

	 * point to original read only copy if section is not allocatable.

	 * Otherwise it will point to temporary copy which will be relocated.

	 *

	 * Use ->sh_addr to contain final address of the section where it

	 * will go during execution time.

	 */

	for (i = 0; i < pi->ehdr->e_shnum; i++) {

		if (sechdrs[i].sh_type == SHT_NOBITS)

			continue;



		sechdrs[i].sh_offset = (unsigned long)pi->ehdr +

						sechdrs[i].sh_offset;

	}



	offset = 0;

	bss_addr = kbuf->mem + kbuf->bufsz;

	kbuf->image->start = pi->ehdr->e_entry;
@@ -847,17 +829,12 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi, 
			kbuf->image->start += kbuf->mem + offset;

		}



		src = (void *)sechdrs[i].sh_offset;

		src = (void *)pi->ehdr + sechdrs[i].sh_offset;

		dst = pi->purgatory_buf + offset;

		memcpy(dst, src, sechdrs[i].sh_size);



		sechdrs[i].sh_addr = kbuf->mem + offset;



		/*

		 * This section got copied to temporary buffer. Update

		 * ->sh_offset accordingly.

		 */

		sechdrs[i].sh_offset = (unsigned long)dst;

		sechdrs[i].sh_offset = offset;

		offset += sechdrs[i].sh_size;

	}
@@ -1067,7 +1044,7 @@ int kexec_purgatory_get_set_symbol(struct kimage *image, const char *name, 
		return -EINVAL;

	}



	sym_buf = (char *)sec->sh_offset + sym->st_value;

	sym_buf = (char *)pi->purgatory_buf + sec->sh_offset + sym->st_value;



	if (get_value)

		memcpy((void *)buf, sym_buf, size);