espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-06-26 13:56:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

PR28055, segfault in bpf special reloc function

Browse Source 
The testcase in this PR tickled two bugs fixed here.  output_bfd is
NULL when a reloc special_function is called for final linking and
when called from bfd_generic_get_relocated_section_contents.  Clearly
using output_bfd is wrong as it results in segfaults.  Not only that,
the endianness of the reloc field really should be that of the input.
The second bug was not checking that the entire reloc field was
contained in the section contents.

	PR 28055
	* elf64-bpf.c (bpf_elf_generic_reloc): Use correct bfd for bfd_put
	and bfd_put_32 calls.  Correct section limit checks.
This commit is contained in:
Alan Modra
2021-07-05 16:31:30 +09:30
parent 40e1d303ce
commit b4c4b8aaad
2 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
bfd/ChangeLog
View File

@ -1,3 +1,9 @@
2021-07-05 Alan Modra <amodra@gmail.com>
PR 28055
* elf64-bpf.c (bpf_elf_generic_reloc): Use correct bfd for bfd_put
and bfd_put_32 calls. Correct section limit checks.
2021-07-03 Nick Clifton <nickc@redhat.com> 2021-07-03 Nick Clifton <nickc@redhat.com>
* version.m4: Update version number. * version.m4: Update version number.

21
bfd/elf64-bpf.c
View File

@ -589,14 +589,15 @@ elf64_bpf_merge_private_bfd_data (bfd *ibfd, struct bfd_link_info *info)
} }
/* A generic howto special function for installing BPF relocations. /* A generic howto special function for installing BPF relocations.
This function will be called by the assembler (via bfd_install_relocation). This function will be called by the assembler (via bfd_install_relocation),
and by various get_relocated_section_contents functions.
At link time, bpf_elf_relocate_section will resolve the final relocations. At link time, bpf_elf_relocate_section will resolve the final relocations.
BPF instructions are always big endian, and this approach avoids problems in BPF instructions are always big endian, and this approach avoids problems in
bfd_install_relocation. */ bfd_install_relocation. */
static bfd_reloc_status_type static bfd_reloc_status_type
bpf_elf_generic_reloc (bfd * abfd, arelent *reloc_entry, asymbol *symbol, bpf_elf_generic_reloc (bfd *abfd, arelent *reloc_entry, asymbol *symbol,
void *data, asection *input_section, void *data, asection *input_section,
bfd *output_bfd, bfd *output_bfd,
char **error_message ATTRIBUTE_UNUSED) char **error_message ATTRIBUTE_UNUSED)
@ -607,7 +608,15 @@ bpf_elf_generic_reloc (bfd * abfd, arelent *reloc_entry, asymbol *symbol,
bfd_byte *where; bfd_byte *where;
/* Sanity check that the address is in range. */ /* Sanity check that the address is in range. */
if (reloc_entry->address > bfd_get_section_limit (abfd, input_section)) if (reloc_entry->howto->type == R_BPF_INSN_64)
{
bfd_size_type end = bfd_get_section_limit_octets (abfd, input_section);
if (reloc_entry->address > end
|| end - reloc_entry->address < 16)
return bfd_reloc_outofrange;
}
else if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd, input_section,
reloc_entry->address))
return bfd_reloc_outofrange; return bfd_reloc_outofrange;
/* Get the symbol value. */ /* Get the symbol value. */
@ -640,15 +649,15 @@ bpf_elf_generic_reloc (bfd * abfd, arelent *reloc_entry, asymbol *symbol,
instructions, and the upper 32 bits placed at the very end of the instructions, and the upper 32 bits placed at the very end of the
instruction. that is, there are 32 unused bits between them. */ instruction. that is, there are 32 unused bits between them. */
bfd_put_32 (output_bfd, (relocation & 0xFFFFFFFF), where + 4); bfd_put_32 (abfd, (relocation & 0xFFFFFFFF), where + 4);
bfd_put_32 (output_bfd, (relocation >> 32), where + 12); bfd_put_32 (abfd, (relocation >> 32), where + 12);
} }
else else
{ {
/* For other kinds of relocations, the relocated value simply goes /* For other kinds of relocations, the relocated value simply goes
BITPOS bits from the start of the entry. This is always a multiple BITPOS bits from the start of the entry. This is always a multiple
of 8, i.e. whole bytes. */ of 8, i.e. whole bytes. */
bfd_put (reloc_entry->howto->bitsize, output_bfd, relocation, bfd_put (reloc_entry->howto->bitsize, abfd, relocation,
where + reloc_entry->howto->bitpos / 8); where + reloc_entry->howto->bitpos / 8);
} }