Commit 211d6260 authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging 



Multiboot patches

# gpg: Signature made Wed 21 Mar 2018 14:38:36 GMT
# gpg:                using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>"
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  tests/multiboot: Add .gitignore
  tests/multiboot: Add tests for the a.out kludge
  tests/multiboot: Test exit code for every qemu run
  multiboot: Check validity of mh_header_addr
  multiboot: Reject kernels exceeding the address space

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents 99728ba3 e2679395

hw/i386/multiboot.c

+8 −0
Original line number Diff line number Diff line
@@ -229,6 +229,10 @@ int load_multiboot(FWCfgState *fw_cfg, 
            error_report("invalid load_addr address");

            exit(1);

        }

        if (mh_header_addr - mh_load_addr > i) {

            error_report("invalid header_addr address");

            exit(1);

        }



        uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr);

        uint32_t mb_load_size = 0;
@@ -247,6 +251,10 @@ int load_multiboot(FWCfgState *fw_cfg, 
            }

            mb_load_size = kernel_file_size - mb_kernel_text_offset;

        }

        if (mb_load_size > UINT32_MAX - mh_load_addr) {

            error_report("kernel does not fit in address space");

            exit(1);

        }

        if (mh_bss_end_addr) {

            if (mh_bss_end_addr < (mh_load_addr + mb_load_size)) {

                error_report("invalid bss_end_addr address");

tests/multiboot/.gitignore

0 → 100644
+3 −0
Original line number Diff line number Diff line 
*.bin

*.elf

test.out

tests/multiboot/Makefile

+16 −6
Original line number Diff line number Diff line
@@ -3,16 +3,26 @@ CCFLAGS=-m32 -Wall -Wextra -Werror -fno-stack-protector -nostdinc -fno-builtin 
ASFLAGS=-m32



LD=ld

LDFLAGS=-melf_i386 -T link.ld

LDFLAGS_ELF=-melf_i386 -T link.ld

LDFLAGS_BIN=-melf_i386 -T link.ld --oformat=binary

LIBS=$(shell $(CC) $(CCFLAGS) -print-libgcc-file-name)



all: mmap.elf modules.elf

AOUT_KLUDGE_BIN=$(foreach x,$(shell seq 1 9),aout_kludge_$x.bin)



mmap.elf: start.o mmap.o libc.o

	$(LD) $(LDFLAGS) -o $@ $^ $(LIBS)

all: mmap.elf modules.elf $(AOUT_KLUDGE_BIN)



modules.elf: start.o modules.o libc.o

	$(LD) $(LDFLAGS) -o $@ $^ $(LIBS)

mmap.elf: start.o mmap.o libc.o link.ld

	$(LD) $(LDFLAGS_ELF) -o $@ $^ $(LIBS)



modules.elf: start.o modules.o libc.o link.ld

	$(LD) $(LDFLAGS_ELF) -o $@ $^ $(LIBS)



aout_kludge_%.bin: aout_kludge_%.o link.ld

	$(LD) $(LDFLAGS_BIN) -o $@ $^ $(LIBS)



.PRECIOUS: aout_kludge_%.o

aout_kludge_%.o: aout_kludge.S

	$(CC) $(ASFLAGS) -DSCENARIO=$* -c -o $@ $^



%.o: %.c

	$(CC) $(CCFLAGS) -c -o $@ $^

tests/multiboot/aout_kludge.S

0 → 100644
+138 −0
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2018 Kevin Wolf <kwolf@redhat.com>

 *

 * Permission is hereby granted, free of charge, to any person obtaining a copy

 * of this software and associated documentation files (the "Software"), to deal

 * in the Software without restriction, including without limitation the rights

 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

 * copies of the Software, and to permit persons to whom the Software is

 * furnished to do so, subject to the following conditions:

 *

 * The above copyright notice and this permission notice shall be included in

 * all copies or substantial portions of the Software.

 *

 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL

 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

 * THE SOFTWARE.

 */



.section multiboot



#define MB_MAGIC 0x1badb002

#define MB_FLAGS 0x10000

#define MB_CHECKSUM -(MB_MAGIC + MB_FLAGS)



.align  4

.int    MB_MAGIC

.int    MB_FLAGS

.int    MB_CHECKSUM



#define LAST_BYTE_VALUE 0xa5



/*

 * Order of fields in the a.out kludge header fields:

 *

 * header_addr

 * load_addr

 * load_end_addr

 * bss_end_addr

 * entry_addr

 */

#if SCENARIO == 1

/* Well-behaved kernel file with explicit bss_end */

.int    0x100000

.int    0x100000

.int    data_end

.int    data_end

.int    _start

#elif SCENARIO == 2

/* Well-behaved kernel file with default bss_end */

.int    0x100000

.int    0x100000

.int    data_end

.int    0

.int    _start

#elif SCENARIO == 3

/* Well-behaved kernel file with default load_end */

.int    0x100000

.int    0x100000

.int    0

.int    0

.int    _start

#elif SCENARIO == 4

/* Well-behaved kernel file with load_end < data_end and bss > data_end */

#undef LAST_BYTE_VALUE

#define LAST_BYTE_VALUE 0

.int    0x100000

.int    0x100000

.int    code_end

.int    0x140000

.int    _start

#elif SCENARIO == 5

/* header < load */

.int    0x10000

.int    0x100000

.int    data_end

.int    data_end

.int    _start

#elif SCENARIO == 6

/* load_end < load */

.int    0x100000

.int    0x100000

.int    0x10000

.int    data_end

.int    _start

#elif SCENARIO == 7

/* header much larger than in reality with default load_end */

.int    0x80000000

.int    0x100000

.int    0

.int    data_end

.int    _start

#elif SCENARIO == 8

/* bss_end < load_end - load (regression test for CVE-2018-7550) */

.int    0x100000

.int    0x100000

.int    data_end

.int    code_end

.int    _start

#elif SCENARIO == 9

/* Default load_end_addr, load_addr + kernel_file_size > UINT32_MAX */

.int    0xfffff000

.int    0xfffff000

.int    0

.int    0xfffff001

.int    _start

#else

#error Invalid SCENARIO

#endif



.section .text

.global _start

_start:

    xor     %eax, %eax



    cmpb    $LAST_BYTE_VALUE, last_byte

    je      passed

    or      $0x1, %eax

passed:



    /* Test device exit */

    outl    %eax, $0xf4



    cli

    hlt

    jmp .

code_end:



#if SCENARIO != 8

.space 8192

#endif



last_byte:

.byte 0xa5

data_end:

tests/multiboot/aout_kludge.out

0 → 100644
+42 −0
Original line number Diff line number Diff line 






=== Running test case: aout_kludge_1.bin  ===







=== Running test case: aout_kludge_2.bin  ===







=== Running test case: aout_kludge_3.bin  ===







=== Running test case: aout_kludge_4.bin  ===







=== Running test case: aout_kludge_5.bin  ===



qemu-system-x86_64: invalid load_addr address





=== Running test case: aout_kludge_6.bin  ===



qemu-system-x86_64: invalid load_end_addr address





=== Running test case: aout_kludge_7.bin  ===



qemu-system-x86_64: invalid header_addr address





=== Running test case: aout_kludge_8.bin  ===



qemu-system-x86_64: invalid bss_end_addr address





=== Running test case: aout_kludge_9.bin  ===



qemu-system-x86_64: kernel does not fit in address space