source: mainline/boot/generic/src/payload.c@ 28a5ebd

lfn serial ticket/834-toolchain-update topic/msim-upgrade topic/simplify-dev-export
Last change on this file since 28a5ebd was df7dc9e, checked in by Petr Pavlu <setup@…>, 5 years ago

Fix a NULL pointer access when boot components are uncompressed

When boot components are not compressed, their names do not have any
file extension. When checking whether a component is a GZIP file, code
in payload.c calls function isgzip(s) with `s' being a component name.
The name is passed to ext() which returns NULL if no extension is
present. The result is directly passed by isgzip() to str_cmp() and
would cause a NULL pointer access in the latter function.

Fix this by updating function isgzip() to check a result from the ext()
call. For consistency, update similarly function basename() in the same
file.

  • Property mode set to 100644
File size: 8.1 KB
Line 
1/*
2 * Copyright (c) 2007 Michal Kebrt
3 * Copyright (c) 2018 Jiří Zárevúcky
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * - Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * - Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * - The name of the author may not be used to endorse or promote products
16 * derived from this software without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 */
29
30#include <payload.h>
31
32#include <align.h>
33#include <printf.h>
34#include <arch/arch.h>
35#include <tar.h>
36#include <gzip.h>
37#include <stdbool.h>
38#include <memstr.h>
39#include <errno.h>
40#include <str.h>
41#include <halt.h>
42
43static const char *ext(const char *s)
44{
45 const char *last = s;
46
47 while (*s) {
48 if (*s == '.')
49 last = s;
50
51 s++;
52 }
53
54 if (*last == '.')
55 return last;
56
57 return NULL;
58}
59
60static void basename(char *s)
61{
62 char *e = (char *) ext(s);
63 if (e != NULL && str_cmp(e, ".gz") == 0)
64 *e = '\0';
65}
66
67static bool isgzip(const char *s)
68{
69 const char *e = ext(s);
70 return e != NULL && str_cmp(e, ".gz") == 0;
71}
72
73static bool overlaps(uint8_t *start1, uint8_t *end1,
74 uint8_t *start2, uint8_t *end2)
75{
76 return !(end1 <= start2 || end2 <= start1);
77}
78
79static bool extract_component(uint8_t **cstart, uint8_t *cend,
80 uint8_t *ustart, uint8_t *uend, uintptr_t actual_ustart,
81 void (*clear_cache)(void *, size_t), task_t *task)
82{
83 const char *name;
84 const uint8_t *data;
85 size_t packed_size;
86 size_t unpacked_size;
87
88 if (!tar_info(*cstart, cend, &name, &packed_size))
89 return false;
90
91 data = *cstart + TAR_BLOCK_SIZE;
92 *cstart += TAR_BLOCK_SIZE + ALIGN_UP(packed_size, TAR_BLOCK_SIZE);
93
94 bool gz = isgzip(name);
95
96 unpacked_size = gz ? gzip_size(data, packed_size) : packed_size;
97
98 /* Components must be page-aligned. */
99 uint8_t *new_ustart = (uint8_t *) ALIGN_UP((uintptr_t) ustart, PAGE_SIZE);
100 actual_ustart += new_ustart - ustart;
101 ustart = new_ustart;
102 uint8_t *comp_end = ustart + unpacked_size;
103
104 /* Check limits and overlap. */
105 if (overlaps(ustart, comp_end, loader_start, loader_end)) {
106 /* Move the component after bootloader. */
107 printf("%s would overlap bootloader, moving to %p.\n", name, loader_end);
108 uint8_t *new_ustart = (uint8_t *) ALIGN_UP((uintptr_t) loader_end, PAGE_SIZE);
109 actual_ustart += new_ustart - ustart;
110 ustart = new_ustart;
111 comp_end = ustart + unpacked_size;
112 }
113
114 if (comp_end > uend) {
115 printf("Not enough available memory for remaining components"
116 " (at least %zd more required).\n", comp_end - uend);
117 halt();
118 }
119
120 printf(" %p|%p: %s image (%zu/%zu bytes)\n", (void *) actual_ustart,
121 ustart, name, unpacked_size, packed_size);
122
123 if (task) {
124 task->addr = (void *) actual_ustart;
125 task->size = unpacked_size;
126 str_cpy(task->name, BOOTINFO_TASK_NAME_BUFLEN, name);
127 /* Remove .gz extension */
128 if (gz)
129 basename(task->name);
130 }
131
132 if (gz) {
133 int rc = gzip_expand(data, packed_size, ustart, unpacked_size);
134 if (rc != EOK) {
135 printf("\n%s: Inflating error %d\n", name, rc);
136 halt();
137 }
138 } else {
139 memcpy(ustart, data, unpacked_size);
140 }
141
142 if (clear_cache)
143 clear_cache(ustart, unpacked_size);
144
145 return true;
146}
147
148/* @return Bytes needed for unpacked payload. */
149size_t payload_unpacked_size(void)
150{
151 size_t sz = 0;
152 uint8_t *start = payload_start;
153 const char *name;
154 size_t packed_size;
155
156 while (tar_info(start, payload_end, &name, &packed_size)) {
157 sz = ALIGN_UP(sz, PAGE_SIZE);
158 if (isgzip(name))
159 sz += gzip_size(start + TAR_BLOCK_SIZE, packed_size);
160 else
161 sz += packed_size;
162
163 start += TAR_BLOCK_SIZE + ALIGN_UP(packed_size, TAR_BLOCK_SIZE);
164 }
165
166 return sz;
167}
168
169/**
170 * Extract the payload (kernel, loader, init binaries and the initrd image).
171 *
172 * @param bootinfo Pointer to the structure where the actual placement
173 * of components is recorded.
174 *
175 * @param kernel_dest Address of the kernel in the bootloader's address space.
176 * Kernel is the only part of the payload that has a fixed
177 * location and cannot be moved. If the kernel doesn't fit
178 * or would overlap bootloader, bootloader halts.
179 *
180 * @param mem_end End of usable contiguous memory.
181 * The caller guarantees that the entire area between
182 * kernel_start and mem_end is free and safe to write to,
183 * save possibly for the interval [loader_start, loader_end).
184 * All components are placed in this area. If there is not
185 * enough space for all components, bootloader halts.
186 *
187 * @param kernel_start Address the kernel will have in the kernel's own
188 * address space.
189 *
190 * @param clear_cache Caller-provided function for assuring cache coherence,
191 * whatever that means for a given platform. May be NULL.
192 */
193void extract_payload(taskmap_t *tmap, uint8_t *kernel_dest, uint8_t *mem_end,
194 uintptr_t kernel_start, void (*clear_cache)(void *, size_t))
195{
196 task_t task;
197 memset(&task, 0, sizeof(task));
198
199 printf("Boot loader: %p -> %p\n", loader_start, loader_end);
200 printf("Payload: %p -> %p\n", payload_start, payload_end);
201 printf("Kernel load address: %p\n", kernel_dest);
202 printf("Kernel start: %p\n", (void *) kernel_start);
203 printf("RAM end: %p (%zd bytes available)\n", mem_end,
204 mem_end - kernel_dest);
205
206 size_t payload_size = payload_end - payload_start;
207 uint8_t *real_payload_start;
208 uint8_t *real_payload_end;
209
210 if (overlaps(kernel_dest, mem_end, payload_start, payload_end)) {
211 /*
212 * First, move the payload to the very end of available memory,
213 * to make space for the unpacked data.
214 */
215 real_payload_start = (uint8_t *) ALIGN_DOWN((uintptr_t)(mem_end - payload_size), PAGE_SIZE);
216 real_payload_end = real_payload_start + payload_size;
217 memmove(real_payload_start, payload_start, payload_size);
218
219 printf("Moved payload: %p -> %p\n", real_payload_start, real_payload_end);
220 } else {
221 real_payload_start = payload_start;
222 real_payload_end = payload_end;
223 }
224
225 printf("\nInflating components ... \n");
226
227 uint8_t *end = mem_end;
228
229 if (real_payload_end > kernel_dest && real_payload_start < mem_end)
230 end = real_payload_start;
231
232 /* Kernel is always first. */
233 if (!extract_component(&real_payload_start, real_payload_end,
234 kernel_dest, end, kernel_start, clear_cache, &task)) {
235 printf("There is no kernel.\n");
236 halt();
237 }
238
239 if ((uintptr_t) task.addr != kernel_start) {
240 printf("Couldn't load kernel at the requested address.\n");
241 halt();
242 }
243
244 tmap->cnt = 0;
245
246 for (int i = 0; i <= TASKMAP_MAX_RECORDS; i++) {
247 /*
248 * `task` holds the location and size of the previous component.
249 */
250 uintptr_t actual_dest =
251 ALIGN_UP((uintptr_t) task.addr + task.size, PAGE_SIZE);
252 uint8_t *dest = kernel_dest + (actual_dest - kernel_start);
253
254 if (real_payload_end > dest && real_payload_start < mem_end)
255 end = real_payload_start;
256
257 if (!extract_component(&real_payload_start, real_payload_end,
258 dest, end, actual_dest, clear_cache, &task))
259 break;
260
261 if (i >= TASKMAP_MAX_RECORDS) {
262 printf("More components than the maximum of %d.\n",
263 TASKMAP_MAX_RECORDS);
264 halt();
265 }
266
267 tmap->tasks[i] = task;
268 tmap->cnt = i + 1;
269 }
270
271 printf("Done.\n");
272}
Note: See TracBrowser for help on using the repository browser.