Given that the decompressor already incorporates an ELF loader that parses the program headers of the decompressed ELF image, support for dealing with the PT_DYNAMIC program header can be added quite easily, which describes the location of the RELA and RELR relocation tables in the image.
This is a more efficient, and more idiomatic format, which allows the handling of boot-time randomization (KASLR) in a generic manner, rather than based on a bespoke x86-specific relocation format. This is a prerequisite for enabling further hardening measures that are implemented in the ELF domain, i.e., fgkaslr. Signed-off-by: Ard Biesheuvel <[email protected]> --- arch/x86/boot/compressed/misc.c | 73 +++++++++++++++++++- include/uapi/linux/elf.h | 3 + 2 files changed, 74 insertions(+), 2 deletions(-) diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c index 1ea419cf88fe..bc5677e697ca 100644 --- a/arch/x86/boot/compressed/misc.c +++ b/arch/x86/boot/compressed/misc.c @@ -278,7 +278,68 @@ static inline void handle_relocations(void *output, unsigned long output_len, { } #endif -static size_t parse_elf(void *output) +#define ELF(type) __PASTE(__PASTE(Elf, __LONG_WIDTH__), __PASTE(_, type)) + +static void handle_dynamic(const ELF(Dyn) *dyn, unsigned long p2v_offset, + unsigned long va_shift) +{ + const ELF(Rela) *rela = NULL; + const ELF(Rel) *rel = NULL; + unsigned long *relr = NULL; + unsigned long *place; + int relasize = 0; + int relrsize = 0; + int relsize = 0; + + for (auto d = dyn; d->d_tag != DT_NULL; d++) { + switch (d->d_tag) { + case DT_RELA: + rela = (void *)(d->d_un.d_ptr + p2v_offset); + break; + case DT_RELASZ: + relasize = d->d_un.d_val; + break; + case DT_RELR: + relr = (void *)(d->d_un.d_ptr + p2v_offset); + break; + case DT_RELRSZ: + relrsize = d->d_un.d_val; + break; + case DT_REL: + rel = (void *)(d->d_un.d_ptr + p2v_offset); + break; + case DT_RELSZ: + relsize = d->d_un.d_val; + break; + } + } + + for (int i = 0; i < relasize / sizeof(*rela); i++) { + place = (unsigned long *)(rela[i].r_offset + p2v_offset); + *place += va_shift; + } + + for (int i = 0; i < relrsize / sizeof(*relr); i++) { + if ((relr[i] & 1) == 0) { + place = (unsigned long *)(relr[i] + p2v_offset); + *place++ += va_shift; + continue; + } + + for (unsigned long *p = place, r = relr[i] >> 1; r; p++, r >>= 1) + if (r & 1) + *p += va_shift; + place += 8 * sizeof(*relr) - 1; + } + + for (int i = 0; i < relsize / sizeof(*rel); i++) { + place = (unsigned long *)(rel[i].r_offset + p2v_offset); + *place += va_shift; + } + +} + +static size_t parse_elf(void *output, u64 va_shift) { #ifdef CONFIG_X86_64 Elf64_Ehdr ehdr; @@ -320,6 +381,12 @@ static size_t parse_elf(void *output) dest += (unsigned long)output - LOAD_PHYSICAL_ADDR; memmove(dest, output + phdr->p_offset, phdr->p_filesz); break; + case PT_DYNAMIC: + if (!va_shift) + break; + dest = (void *)(output + phdr->p_paddr - LOAD_PHYSICAL_ADDR); + handle_dynamic(dest, (unsigned long)dest - phdr->p_vaddr, va_shift); + break; default: /* Ignore other PT_* */ break; } } @@ -351,7 +418,9 @@ unsigned long decompress_kernel(unsigned char *outbuf, unsigned long virt_addr, NULL, error) < 0) return ULONG_MAX; - entry = parse_elf(outbuf); + if (IS_ENABLED(CONFIG_X86_32)) + virt_addr = (unsigned long)outbuf; + entry = parse_elf(outbuf, virt_addr - LOAD_PHYSICAL_ADDR); handle_relocations(outbuf, output_len, virt_addr); return entry; diff --git a/include/uapi/linux/elf.h b/include/uapi/linux/elf.h index 819ded2d39de..868cd67f0ea7 100644 --- a/include/uapi/linux/elf.h +++ b/include/uapi/linux/elf.h @@ -103,6 +103,9 @@ typedef __u16 Elf64_Versym; #define DT_TEXTREL 22 #define DT_JMPREL 23 #define DT_ENCODING 32 +#define DT_RELRSZ 35 +#define DT_RELR 36 +#define DT_RELRENT 37 #define OLD_DT_LOOS 0x60000000 #define DT_LOOS 0x6000000d #define DT_HIOS 0x6ffff000 -- 2.47.3
