[PATCH v1] lib: elf: Fix bootelf -p crash issue

JianfengA.Zhu at sony.com JianfengA.Zhu at sony.com
Wed Aug 7 04:20:07 CEST 2024


Do not load and flush segments whose program header type is not
PT_LOAD to avoid crash happen.

bootelf will load all program headers and then flush cache.
Since PT_GNU_STACK start address is 0x0, crash happens when
it flushes PT_GNU_STACK area for target that memory cannot be
accessed from address 0x0.

crash call stack:
====================================================================
bootelf -p
|-> do_bootelf (cmd/elf.c)
 |-> load_elf_image_phdr (lib/elf.c) /* Load each program header */
  |-> for (i = 0; i < ehdr->e_phnum; ++i) { /* e_phnum is 2 */
   |-> flush_cache(start=0, size=0) (arch/arm/lib/cache.c) (*1)
    |-> flush_dcache_range(start=0, 0); (arch/arm/cpu/armv8/cache_v8.c)
     |-> __asm_flush_dcache_range(start=0, 0) (arch/arm/cpu/armv8/cache.S)
      |-> /* clean & invalidate data or unified cache */
      |-> dc      civac, x0       <<== crash happen x0:start=0
====================================================================
*1 Here the p_paddr and p_filesz of the GNU_STACK program are 0.

hello_world elf image program headers
====================================================================
Program Headers:
  Type           Offset             VirtAddr           PhysAddr
                 FileSiz            MemSiz              Flags  Align
  LOAD           0x0000000000000000 0x0000000080ff0000 0x0000000080ff0000
                 0x0000000000010390 0x0000000000010390  R E    0x10000
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RW     0x10

 Section to Segment mapping:
  Segment Sections...
   00     .text .rodata .eh_frame
   01
====================================================================

bootelf -p crash error log
====================================================================
bootelf -p 0x80f00000
"Synchronous Abort" handler, esr 0x96000147, far 0x0
elr: 000000008f6035bc lr : 000000008f66ff54 (reloc)
elr: 00000000bd9475bc lr : 00000000bd9b3f54
x0 : 0000000000000000 x1 : 0000000000000000
x2 : 0000000000000040 x3 : 000000000000003f
x4 : 0000000081000390 x5 : 00000000bd12da98
x6 : 0000000000000010 x7 : 0000000000000010
x8 : 000000000000000a x9 : 00000000bd156b30
x10: 00000000bd1526e0 x11: 0000000000000000
x12: 0000000000000004 x13: 00000000bda00000
x14: 00000000ffffffff x15: 00000000bd12dab7
x16: 00000000bd957b14 x17: 0000000000000000
x18: 00000000bd13fd90 x19: 0000000080f000b0
x20: 0000000080f00000 x21: 0000000000000002
x22: 0000000000000000 x23: 0000000000000003
x24: 00000000bd9eacc0 x25: 0000000000000000
x26: 0000000000000000 x27: 0000000000000000
x28: 00000000bd154c80 x29: 00000000bd12da70

Code: d2800082 9ac32042 d1000443 8a230000 (d50b7e20)
====================================================================

Signed-off-by: Jianfeng Zhu <JianfengA.Zhu at sony.com>
Reviewed-by: Jacky Cao <Jacky.Cao at sony.com>
Reviewed-by: Toyama, Yoshihiro <Yoshihiro.Toyama at sony.com>
---
 lib/elf.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/elf.c b/lib/elf.c
index dc13935e10..28ec87b8e4 100644
--- a/lib/elf.c
+++ b/lib/elf.c
@@ -90,6 +90,10 @@ unsigned long load_elf64_image_phdr(unsigned long addr)
 		void *dst = (void *)(ulong)phdr->p_paddr;
 		void *src = (void *)addr + phdr->p_offset;
 
+		/* Only load PT_LOAD program header */
+		if (phdr->p_type != PT_LOAD)
+			continue;
+
 		debug("Loading phdr %i to 0x%p (%lu bytes)\n",
 		      i, dst, (ulong)phdr->p_filesz);
 		if (phdr->p_filesz)
@@ -205,6 +209,10 @@ unsigned long load_elf_image_phdr(unsigned long addr)
 		void *dst = (void *)(uintptr_t)phdr->p_paddr;
 		void *src = (void *)addr + phdr->p_offset;
 
+		/* Only load PT_LOAD program header */
+		if (phdr->p_type != PT_LOAD)
+			continue;
+
 		debug("Loading phdr %i to 0x%p (%i bytes)\n",
 		      i, dst, phdr->p_filesz);
 		if (phdr->p_filesz)
-- 
2.25.1


More information about the U-Boot mailing list