Multiboot patches
-----BEGIN PGP SIGNATURE----- iQIcBAABAgAGBQJasm5sAAoJEH8JsnLIjy/WQIoP/i+eMqx3JyaHneycZX5oooqF JHjMWTlCBrVqlj0bozmgV5moya8Crg7TbpdRCWoyQuHpWz/mLIWaY6R0rx688/A1 WsuYHeC853+6Uq/tXEaajfKK1o/AVdOQYsM5rGtKJ3kvzJfUPiVHy+8R0fvWaAvB cSONmgk+gsxL6NT+ltYEPMz6cZL9xZbRRPLX8gCAVSlOM51ESJaRwD8dtUkypM2M Ej7P1b1ukarhgZj0UmDlgDAF5HBvLOiJszabh4jmzFQYwCW3ed5sVLyFLbLmxzz+ yO8iMdvh7lw8Q0krbArXyrEjuBvdUee3deveZ63hXpWKtR4K35Zysg/axWRj1RhX lsjJtcay13rwp6MMRXM16rvjI44Nrdjqsrl8aTPd9ISUDDRpfNRk6eAlusBQ+Udr Sqdevf6c5oIufqWtAfXsfP4T58Lt92mi9fO3+TbtREF1c20zP6I1XDSFdZuA+BtQ Cl92rIRmhTp1n4VFMMjvl3d0b9pbZrdeYrbXgGeE6FXiHAjeSzVLAk7QTJuKRGUW TcxlVmcpA2igfSBrniIqNZF66T17eWwJi3iqzzeCMudEdP5ETx9Hg0eCuFpgK5Kg PEcVDlmvaspztmn6Q/jJepNa8Mu2bbmt7xaCYRtymzIQinfOkmzDfC5DgqMagayC LQDy7zqq4KA26gzUAH2z =xuRL -----END PGP SIGNATURE----- Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging Multiboot patches # gpg: Signature made Wed 21 Mar 2018 14:38:36 GMT # gpg: using RSA key 7F09B272C88F2FD6 # gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" # Primary key fingerprint: DC3D EB15 9A9A F95D 3D74 56FE 7F09 B272 C88F 2FD6 * remotes/kevin/tags/for-upstream: tests/multiboot: Add .gitignore tests/multiboot: Add tests for the a.out kludge tests/multiboot: Test exit code for every qemu run multiboot: Check validity of mh_header_addr multiboot: Reject kernels exceeding the address space Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell
commit
211d626020
@ -229,6 +229,10 @@ int load_multiboot(FWCfgState *fw_cfg,
|
||||
error_report("invalid load_addr address");
|
||||
exit(1);
|
||||
}
|
||||
if (mh_header_addr - mh_load_addr > i) {
|
||||
error_report("invalid header_addr address");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr);
|
||||
uint32_t mb_load_size = 0;
|
||||
@ -247,6 +251,10 @@ int load_multiboot(FWCfgState *fw_cfg,
|
||||
}
|
||||
mb_load_size = kernel_file_size - mb_kernel_text_offset;
|
||||
}
|
||||
if (mb_load_size > UINT32_MAX - mh_load_addr) {
|
||||
error_report("kernel does not fit in address space");
|
||||
exit(1);
|
||||
}
|
||||
if (mh_bss_end_addr) {
|
||||
if (mh_bss_end_addr < (mh_load_addr + mb_load_size)) {
|
||||
error_report("invalid bss_end_addr address");
|
||||
|
||||
3
tests/multiboot/.gitignore
vendored
Normal file
3
tests/multiboot/.gitignore
vendored
Normal file
@ -0,0 +1,3 @@
|
||||
*.bin
|
||||
*.elf
|
||||
test.out
|
||||
@ -3,16 +3,26 @@ CCFLAGS=-m32 -Wall -Wextra -Werror -fno-stack-protector -nostdinc -fno-builtin
|
||||
ASFLAGS=-m32
|
||||
|
||||
LD=ld
|
||||
LDFLAGS=-melf_i386 -T link.ld
|
||||
LDFLAGS_ELF=-melf_i386 -T link.ld
|
||||
LDFLAGS_BIN=-melf_i386 -T link.ld --oformat=binary
|
||||
LIBS=$(shell $(CC) $(CCFLAGS) -print-libgcc-file-name)
|
||||
|
||||
all: mmap.elf modules.elf
|
||||
AOUT_KLUDGE_BIN=$(foreach x,$(shell seq 1 9),aout_kludge_$x.bin)
|
||||
|
||||
mmap.elf: start.o mmap.o libc.o
|
||||
$(LD) $(LDFLAGS) -o $@ $^ $(LIBS)
|
||||
all: mmap.elf modules.elf $(AOUT_KLUDGE_BIN)
|
||||
|
||||
modules.elf: start.o modules.o libc.o
|
||||
$(LD) $(LDFLAGS) -o $@ $^ $(LIBS)
|
||||
mmap.elf: start.o mmap.o libc.o link.ld
|
||||
$(LD) $(LDFLAGS_ELF) -o $@ $^ $(LIBS)
|
||||
|
||||
modules.elf: start.o modules.o libc.o link.ld
|
||||
$(LD) $(LDFLAGS_ELF) -o $@ $^ $(LIBS)
|
||||
|
||||
aout_kludge_%.bin: aout_kludge_%.o link.ld
|
||||
$(LD) $(LDFLAGS_BIN) -o $@ $^ $(LIBS)
|
||||
|
||||
.PRECIOUS: aout_kludge_%.o
|
||||
aout_kludge_%.o: aout_kludge.S
|
||||
$(CC) $(ASFLAGS) -DSCENARIO=$* -c -o $@ $^
|
||||
|
||||
%.o: %.c
|
||||
$(CC) $(CCFLAGS) -c -o $@ $^
|
||||
|
||||
138
tests/multiboot/aout_kludge.S
Normal file
138
tests/multiboot/aout_kludge.S
Normal file
@ -0,0 +1,138 @@
|
||||
/*
|
||||
* Copyright (c) 2018 Kevin Wolf <kwolf@redhat.com>
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
* of this software and associated documentation files (the "Software"), to deal
|
||||
* in the Software without restriction, including without limitation the rights
|
||||
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
* copies of the Software, and to permit persons to whom the Software is
|
||||
* furnished to do so, subject to the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be included in
|
||||
* all copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
||||
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
* THE SOFTWARE.
|
||||
*/
|
||||
|
||||
.section multiboot
|
||||
|
||||
#define MB_MAGIC 0x1badb002
|
||||
#define MB_FLAGS 0x10000
|
||||
#define MB_CHECKSUM -(MB_MAGIC + MB_FLAGS)
|
||||
|
||||
.align 4
|
||||
.int MB_MAGIC
|
||||
.int MB_FLAGS
|
||||
.int MB_CHECKSUM
|
||||
|
||||
#define LAST_BYTE_VALUE 0xa5
|
||||
|
||||
/*
|
||||
* Order of fields in the a.out kludge header fields:
|
||||
*
|
||||
* header_addr
|
||||
* load_addr
|
||||
* load_end_addr
|
||||
* bss_end_addr
|
||||
* entry_addr
|
||||
*/
|
||||
#if SCENARIO == 1
|
||||
/* Well-behaved kernel file with explicit bss_end */
|
||||
.int 0x100000
|
||||
.int 0x100000
|
||||
.int data_end
|
||||
.int data_end
|
||||
.int _start
|
||||
#elif SCENARIO == 2
|
||||
/* Well-behaved kernel file with default bss_end */
|
||||
.int 0x100000
|
||||
.int 0x100000
|
||||
.int data_end
|
||||
.int 0
|
||||
.int _start
|
||||
#elif SCENARIO == 3
|
||||
/* Well-behaved kernel file with default load_end */
|
||||
.int 0x100000
|
||||
.int 0x100000
|
||||
.int 0
|
||||
.int 0
|
||||
.int _start
|
||||
#elif SCENARIO == 4
|
||||
/* Well-behaved kernel file with load_end < data_end and bss > data_end */
|
||||
#undef LAST_BYTE_VALUE
|
||||
#define LAST_BYTE_VALUE 0
|
||||
.int 0x100000
|
||||
.int 0x100000
|
||||
.int code_end
|
||||
.int 0x140000
|
||||
.int _start
|
||||
#elif SCENARIO == 5
|
||||
/* header < load */
|
||||
.int 0x10000
|
||||
.int 0x100000
|
||||
.int data_end
|
||||
.int data_end
|
||||
.int _start
|
||||
#elif SCENARIO == 6
|
||||
/* load_end < load */
|
||||
.int 0x100000
|
||||
.int 0x100000
|
||||
.int 0x10000
|
||||
.int data_end
|
||||
.int _start
|
||||
#elif SCENARIO == 7
|
||||
/* header much larger than in reality with default load_end */
|
||||
.int 0x80000000
|
||||
.int 0x100000
|
||||
.int 0
|
||||
.int data_end
|
||||
.int _start
|
||||
#elif SCENARIO == 8
|
||||
/* bss_end < load_end - load (regression test for CVE-2018-7550) */
|
||||
.int 0x100000
|
||||
.int 0x100000
|
||||
.int data_end
|
||||
.int code_end
|
||||
.int _start
|
||||
#elif SCENARIO == 9
|
||||
/* Default load_end_addr, load_addr + kernel_file_size > UINT32_MAX */
|
||||
.int 0xfffff000
|
||||
.int 0xfffff000
|
||||
.int 0
|
||||
.int 0xfffff001
|
||||
.int _start
|
||||
#else
|
||||
#error Invalid SCENARIO
|
||||
#endif
|
||||
|
||||
.section .text
|
||||
.global _start
|
||||
_start:
|
||||
xor %eax, %eax
|
||||
|
||||
cmpb $LAST_BYTE_VALUE, last_byte
|
||||
je passed
|
||||
or $0x1, %eax
|
||||
passed:
|
||||
|
||||
/* Test device exit */
|
||||
outl %eax, $0xf4
|
||||
|
||||
cli
|
||||
hlt
|
||||
jmp .
|
||||
code_end:
|
||||
|
||||
#if SCENARIO != 8
|
||||
.space 8192
|
||||
#endif
|
||||
|
||||
last_byte:
|
||||
.byte 0xa5
|
||||
data_end:
|
||||
42
tests/multiboot/aout_kludge.out
Normal file
42
tests/multiboot/aout_kludge.out
Normal file
@ -0,0 +1,42 @@
|
||||
|
||||
|
||||
|
||||
=== Running test case: aout_kludge_1.bin ===
|
||||
|
||||
|
||||
|
||||
=== Running test case: aout_kludge_2.bin ===
|
||||
|
||||
|
||||
|
||||
=== Running test case: aout_kludge_3.bin ===
|
||||
|
||||
|
||||
|
||||
=== Running test case: aout_kludge_4.bin ===
|
||||
|
||||
|
||||
|
||||
=== Running test case: aout_kludge_5.bin ===
|
||||
|
||||
qemu-system-x86_64: invalid load_addr address
|
||||
|
||||
|
||||
=== Running test case: aout_kludge_6.bin ===
|
||||
|
||||
qemu-system-x86_64: invalid load_end_addr address
|
||||
|
||||
|
||||
=== Running test case: aout_kludge_7.bin ===
|
||||
|
||||
qemu-system-x86_64: invalid header_addr address
|
||||
|
||||
|
||||
=== Running test case: aout_kludge_8.bin ===
|
||||
|
||||
qemu-system-x86_64: invalid bss_end_addr address
|
||||
|
||||
|
||||
=== Running test case: aout_kludge_9.bin ===
|
||||
|
||||
qemu-system-x86_64: kernel does not fit in address space
|
||||
@ -34,10 +34,21 @@ run_qemu() {
|
||||
-device isa-debugcon,chardev=stdio \
|
||||
-chardev file,path=test.out,id=stdio \
|
||||
-device isa-debug-exit,iobase=0xf4,iosize=0x4 \
|
||||
"$@"
|
||||
"$@" >> test.log 2>&1
|
||||
ret=$?
|
||||
|
||||
cat test.out >> test.log
|
||||
|
||||
debugexit=$((ret & 0x1))
|
||||
ret=$((ret >> 1))
|
||||
|
||||
if [ $debugexit != 1 ]; then
|
||||
printf %b "\e[31m ?? \e[0m $kernel $* (no debugexit used, exit code $ret)\n"
|
||||
pass=0
|
||||
elif [ $ret != 0 ]; then
|
||||
printf %b "\e[31mFAIL\e[0m $kernel $* (exit code $ret)\n"
|
||||
pass=0
|
||||
fi
|
||||
}
|
||||
|
||||
mmap() {
|
||||
@ -56,24 +67,19 @@ modules() {
|
||||
run_qemu modules.elf -initrd "module.txt,module.txt argument,module.txt"
|
||||
}
|
||||
|
||||
aout_kludge() {
|
||||
for i in $(seq 1 9); do
|
||||
run_qemu aout_kludge_$i.bin
|
||||
done
|
||||
}
|
||||
|
||||
make all
|
||||
|
||||
for t in mmap modules; do
|
||||
for t in mmap modules aout_kludge; do
|
||||
|
||||
echo > test.log
|
||||
$t
|
||||
|
||||
debugexit=$((ret & 0x1))
|
||||
ret=$((ret >> 1))
|
||||
pass=1
|
||||
|
||||
if [ $debugexit != 1 ]; then
|
||||
printf %b "\e[31m ?? \e[0m $t (no debugexit used, exit code $ret)\n"
|
||||
pass=0
|
||||
elif [ $ret != 0 ]; then
|
||||
printf %b "\e[31mFAIL\e[0m $t (exit code $ret)\n"
|
||||
pass=0
|
||||
fi
|
||||
$t
|
||||
|
||||
if ! diff $t.out test.log > /dev/null 2>&1; then
|
||||
printf %b "\e[31mFAIL\e[0m $t (output difference)\n"
|
||||
|
||||
Loading…
Reference in New Issue
Block a user