Skip to content

Commit a67d1a8

Browse files
douzzerdouzzer
committed
configure.ac: for linuxkm with PIE, don't include enable-fpcc in enable-all-crypto (the compiler generates a weird out-of-bounds bss reference for find_hole());
linuxkm/Makefile: in recipe (awk script) for wc_linuxkm_pie_reloc_tab.c, report and error on unexpected relocation types; linuxkm/module_hooks.c: in wc_linuxkm_normalize_relocations(): * fix bounds checking on the input, * recognize references pointing at the first byte after the end of the segment, * and mask out pad bytes when rendering the 32 bit addresses; linuxkm/wolfcrypt.lds: add 4k alignment directives just before the segment end fenceposts, to make the fenceposts more inclusive.
1 parent 6f567bb commit a67d1a8

File tree

4 files changed

+46
-21
lines changed

4 files changed

+46
-21
lines changed

‎configure.ac‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1293,7 +1293,6 @@ then
12931293
test "$enable_certext" = "" && enable_certext=yes
12941294
test "$enable_sep" = "" && enable_sep=yes
12951295
test "$enable_hkdf" = "" && enable_hkdf=yes
1296-
test "$enable_fpecc" = "" && test "$enable_ecc" != "no" && enable_fpecc=yes
12971296
test "$enable_eccencrypt" = "" && test "$enable_ecc" != "no" && enable_eccencrypt=yes
12981297
test "$enable_psk" = "" && enable_psk=yes
12991298
test "$enable_cmac" = "" && enable_cmac=yes
@@ -1323,6 +1322,13 @@ then
13231322
test "$enable_anon" = "" && enable_anon=yes
13241323
test "$enable_ssh" = "" && test "$enable_hmac" != "no" && enable_ssh=yes
13251324

1325+
# the compiler optimizer generates a weird out-of-bounds bss reference for
1326+
# find_hole() in the FP_ECC implementation.
1327+
if test "$ENABLED_LINUXKM_PIE" != yes
1328+
then
1329+
test "$enable_fpecc" = "" && test "$enable_ecc" != "no" && enable_fpecc=yes
1330+
fi
1331+
13261332
if test "x$FIPS_VERSION" != "xv1"
13271333
then
13281334
test "$enable_rsapss" = "" && enable_rsapss=yes

‎linuxkm/Makefile‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,8 +105,9 @@ ifeq "$(ENABLED_LINUXKM_PIE)" "yes"
105105
@$(READELF) --wide -r libwolfssl.ko | \
106106
$(AWK) 'BEGIN { \
107107
n=0; \
108+
bad_relocs=0; \
108109
printf("%s\n ", \
109-
"const unsigned int wc_linuxkm_pie_reloc_tab[] = { "); \
110+
"const unsigned int wc_linuxkm_pie_reloc_tab[] = { "); \
110111
} \
111112
/^Relocation section '\''\.rela\.text\.wolfcrypt'\''/ { \
112113
p=1; \
@@ -117,12 +118,20 @@ ifeq "$(ENABLED_LINUXKM_PIE)" "yes"
117118
} \
118119
/^0/ { \
119120
if (p) { \
121+
if ($$3 !~ "^(R_X86_64_PLT32|R_X86_64_PC32|R_AARCH64_.*)$$") { \
122+
print "Unexpected relocation type:\n" $$0 >"/dev/stderr"; \
123+
++bad_relocs; \
124+
} \
120125
printf("0x%s%s", \
121126
gensub("^0*","",1,$$1), \
122127
((++n%8) ? ", " : ",\n ")); \
123128
} \
124129
} \
125130
END { \
131+
if (bad_relocs) { \
132+
print "Found " bad_relocs " unexpected relocations." >"/dev/stderr"; \
133+
exit(1); \
134+
} \
126135
print "~0U };\nconst size_t wc_linuxkm_pie_reloc_tab_length = sizeof wc_linuxkm_pie_reloc_tab / sizeof wc_linuxkm_pie_reloc_tab[0];";\
127136
}' > wc_linuxkm_pie_reloc_tab.c
128137
+$(MAKE) ARCH='$(KERNEL_ARCH)' $(OVERRIDE_PATHS) $(CROSS_COMPILE) -C '$(KERNEL_ROOT)' M='$(MODULE_TOP)' $(KBUILD_EXTRA_FLAGS) CC_FLAGS_FTRACE=

‎linuxkm/module_hooks.c‎

Lines changed: 25 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -611,8 +611,9 @@ ssize_t wc_linuxkm_normalize_relocations(
611611
int n_text_r = 0, n_rodata_r = 0, n_rwdata_r = 0, n_bss_r = 0, n_other_r = 0;
612612
#endif
613613

614-
if ((text_in < __wc_text_start) ||
615-
(text_in >= __wc_text_end))
614+
if ((text_in_len == 0) ||
615+
(text_in < __wc_text_start) ||
616+
(text_in + text_in_len >= __wc_text_end))
616617
{
617618
return -1;
618619
}
@@ -663,7 +664,7 @@ ssize_t wc_linuxkm_normalize_relocations(
663664
abs_ptr = (uintptr_t)text_in + next_reloc + 4 + reloc_buf;
664665

665666
if ((abs_ptr >= (uintptr_t)__wc_text_start) &&
666-
(abs_ptr < (uintptr_t)__wc_text_end))
667+
(abs_ptr <= (uintptr_t)__wc_text_end))
667668
{
668669
/* internal references in the .wolfcrypt.text segment don't need
669670
* normalization.
@@ -674,7 +675,7 @@ ssize_t wc_linuxkm_normalize_relocations(
674675
continue;
675676
}
676677
else if ((abs_ptr >= (uintptr_t)__wc_rodata_start) &&
677-
(abs_ptr < (uintptr_t)__wc_rodata_end))
678+
(abs_ptr <= (uintptr_t)__wc_rodata_end))
678679
{
679680
#ifdef DEBUG_LINUXKM_PIE_SUPPORT
680681
++n_rodata_r;
@@ -684,7 +685,7 @@ ssize_t wc_linuxkm_normalize_relocations(
684685
reloc_buf |= WC_RODATA_TAG;
685686
}
686687
else if ((abs_ptr >= (uintptr_t)__wc_rwdata_start) &&
687-
(abs_ptr < (uintptr_t)__wc_rwdata_end))
688+
(abs_ptr <= (uintptr_t)__wc_rwdata_end))
688689
{
689690
#ifdef DEBUG_LINUXKM_PIE_SUPPORT
690691
++n_rwdata_r;
@@ -694,7 +695,7 @@ ssize_t wc_linuxkm_normalize_relocations(
694695
reloc_buf |= WC_RWDATA_TAG;
695696
}
696697
else if ((abs_ptr >= (uintptr_t)__wc_bss_start) &&
697-
(abs_ptr < (uintptr_t)__wc_bss_end))
698+
(abs_ptr <= (uintptr_t)__wc_bss_end))
698699
{
699700
#ifdef DEBUG_LINUXKM_PIE_SUPPORT
700701
++n_bss_r;
@@ -710,28 +711,33 @@ ssize_t wc_linuxkm_normalize_relocations(
710711
reloc_buf = WC_OTHER_TAG;
711712
#ifdef DEBUG_LINUXKM_PIE_SUPPORT
712713
++n_other_r;
714+
/* we're currently only handling 32 bit relocations (R_X86_64_PLT32
715+
* and R_X86_64_PC32) so the top half of the word64 is padding we
716+
* can lop off for rendering.
717+
*/
713718
pr_notice("found non-wolfcrypt relocation at text offset 0x%x to "
714-
"addr 0x%lx, text=%px-%px, rodata=%px-%px, "
715-
"rwdata=%px-%px, bss=%px-%px\n",
719+
"addr 0x%x, text=%x-%x, rodata=%x-%x, "
720+
"rwdata=%x-%x, bss=%x-%x\n",
716721
wc_linuxkm_pie_reloc_tab[i],
717-
abs_ptr,
718-
__wc_text_start,
719-
__wc_text_end,
720-
__wc_rodata_start,
721-
__wc_rodata_end,
722-
__wc_rwdata_start,
723-
__wc_rwdata_end,
724-
__wc_bss_start,
725-
__wc_bss_end);
722+
(unsigned)(uintptr_t)abs_ptr,
723+
(unsigned)(uintptr_t)__wc_text_start,
724+
(unsigned)(uintptr_t)__wc_text_end,
725+
(unsigned)(uintptr_t)__wc_rodata_start,
726+
(unsigned)(uintptr_t)__wc_rodata_end,
727+
(unsigned)(uintptr_t)__wc_rwdata_start,
728+
(unsigned)(uintptr_t)__wc_rwdata_end,
729+
(unsigned)(uintptr_t)__wc_bss_start,
730+
(unsigned)(uintptr_t)__wc_bss_end);
726731
#endif
727732
}
728733
put_unaligned((u32)reloc_buf, (int32_t *)&text_out[next_reloc]);
729734
}
730735

731736
#ifdef DEBUG_LINUXKM_PIE_SUPPORT
732737
if (n_other_r > 0)
733-
pr_notice("text_in=%px relocs=%d/%d/%d/%d/%d ret = %zu\n",
734-
text_in, n_text_r, n_rodata_r, n_rwdata_r, n_bss_r, n_other_r,
738+
pr_notice("text_in=%x relocs=%d/%d/%d/%d/%d ret = %zu\n",
739+
(unsigned)(uintptr_t)text_in, n_text_r, n_rodata_r,
740+
n_rwdata_r, n_bss_r, n_other_r,
735741
text_in_len);
736742
#endif
737743

‎linuxkm/wolfcrypt.lds‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,28 @@ SECTIONS {
33
.text.wolfcrypt : {
44
__wc_text_start = .;
55
*(.text.wolfcrypt)
6+
. = ALIGN(4096);
67
__wc_text_end = .;
78
}
89
. = ALIGN(4096);
910
.rodata.wolfcrypt : {
1011
__wc_rodata_start = .;
1112
*(.rodata.wolfcrypt)
13+
. = ALIGN(4096);
1214
__wc_rodata_end = .;
1315
}
1416
. = ALIGN(4096);
1517
.data.wolfcrypt : {
1618
__wc_rwdata_start = .;
1719
*(.data.wolfcrypt)
20+
. = ALIGN(4096);
1821
__wc_rwdata_end = .;
1922
}
2023
. = ALIGN(4096);
2124
.bss.wolfcrypt : {
2225
__wc_bss_start = .;
2326
*(.bss.wolfcrypt)
27+
. = ALIGN(4096);
2428
__wc_bss_end = .;
2529
}
2630
. = ALIGN(4096);

0 commit comments

Comments
 (0)