ar71xx: fix NULL pointer dereference in the ethernet driver
[openwrt.git] / target / linux / generic-2.6 / patches-2.6.31 / 027-mips_module_reloc.patch
1 --- a/arch/mips/Makefile
2 +++ b/arch/mips/Makefile
3 @@ -83,7 +83,7 @@ all-$(CONFIG_BOOT_ELF64) := $(vmlinux-64
4 cflags-y += -G 0 -mno-abicalls -fno-pic -pipe
5 cflags-y += -msoft-float
6 LDFLAGS_vmlinux += -G 0 -static -n -nostdlib
7 -MODFLAGS += -mlong-calls
8 +MODFLAGS += -mno-long-calls
9
10 cflags-y += -ffreestanding
11
12 --- a/arch/mips/include/asm/module.h
13 +++ b/arch/mips/include/asm/module.h
14 @@ -9,6 +9,11 @@ struct mod_arch_specific {
15 struct list_head dbe_list;
16 const struct exception_table_entry *dbe_start;
17 const struct exception_table_entry *dbe_end;
18 +
19 + void *plt_tbl;
20 + unsigned int core_plt_offset;
21 + unsigned int core_plt_size;
22 + unsigned int init_plt_offset;
23 };
24
25 typedef uint8_t Elf64_Byte; /* Type for a 8-bit quantity. */
26 --- a/arch/mips/kernel/module.c
27 +++ b/arch/mips/kernel/module.c
28 @@ -43,6 +43,117 @@ static struct mips_hi16 *mips_hi16_list;
29 static LIST_HEAD(dbe_list);
30 static DEFINE_SPINLOCK(dbe_lock);
31
32 +/*
33 + * Get the potential max trampolines size required of the init and
34 + * non-init sections. Only used if we cannot find enough contiguous
35 + * physically mapped memory to put the module into.
36 + */
37 +static unsigned int
38 +get_plt_size(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
39 + const char *secstrings, unsigned int symindex, bool is_init)
40 +{
41 + unsigned long ret = 0;
42 + unsigned int i, j;
43 + Elf_Sym *syms;
44 +
45 + /* Everything marked ALLOC (this includes the exported symbols) */
46 + for (i = 1; i < hdr->e_shnum; ++i) {
47 + unsigned int info = sechdrs[i].sh_info;
48 +
49 + if (sechdrs[i].sh_type != SHT_REL
50 + && sechdrs[i].sh_type != SHT_RELA)
51 + continue;
52 +
53 + /* Not a valid relocation section? */
54 + if (info >= hdr->e_shnum)
55 + continue;
56 +
57 + /* Don't bother with non-allocated sections */
58 + if (!(sechdrs[info].sh_flags & SHF_ALLOC))
59 + continue;
60 +
61 + /* If it's called *.init*, and we're not init, we're
62 + not interested */
63 + if ((strstr(secstrings + sechdrs[i].sh_name, ".init") != 0)
64 + != is_init)
65 + continue;
66 +
67 + syms = (Elf_Sym *) sechdrs[symindex].sh_addr;
68 + if (sechdrs[i].sh_type == SHT_REL) {
69 + Elf_Mips_Rel *rel = (void *) sechdrs[i].sh_addr;
70 + unsigned int size = sechdrs[i].sh_size / sizeof(*rel);
71 +
72 + for (j = 0; j < size; ++j) {
73 + Elf_Sym *sym;
74 +
75 + if (ELF_MIPS_R_TYPE(rel[j]) != R_MIPS_26)
76 + continue;
77 +
78 + sym = syms + ELF_MIPS_R_SYM(rel[j]);
79 + if (!is_init && sym->st_shndx != SHN_UNDEF)
80 + continue;
81 +
82 + ret += 4 * sizeof(int);
83 + }
84 + } else {
85 + Elf_Mips_Rela *rela = (void *) sechdrs[i].sh_addr;
86 + unsigned int size = sechdrs[i].sh_size / sizeof(*rela);
87 +
88 + for (j = 0; j < size; ++j) {
89 + Elf_Sym *sym;
90 +
91 + if (ELF_MIPS_R_TYPE(rela[j]) != R_MIPS_26)
92 + continue;
93 +
94 + sym = syms + ELF_MIPS_R_SYM(rela[j]);
95 + if (!is_init && sym->st_shndx != SHN_UNDEF)
96 + continue;
97 +
98 + ret += 4 * sizeof(int);
99 + }
100 + }
101 + }
102 +
103 + return ret;
104 +}
105 +
106 +#ifndef MODULE_START
107 +static void *alloc_phys(unsigned long size)
108 +{
109 + unsigned order;
110 + struct page *page;
111 + struct page *p;
112 +
113 + size = PAGE_ALIGN(size);
114 + order = get_order(size);
115 +
116 + page = alloc_pages(GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN |
117 + __GFP_THISNODE, order);
118 + if (!page)
119 + return NULL;
120 +
121 + split_page(page, order);
122 +
123 + for (p = page + (size >> PAGE_SHIFT); p < page + (1 << order); ++p)
124 + __free_page(p);
125 +
126 + return page_address(page);
127 +}
128 +#endif
129 +
130 +static void free_phys(void *ptr, unsigned long size)
131 +{
132 + struct page *page;
133 + struct page *end;
134 +
135 + page = virt_to_page(ptr);
136 + end = page + (PAGE_ALIGN(size) >> PAGE_SHIFT);
137 +
138 + for (; page < end; ++page)
139 + __free_page(page);
140 +}
141 +
142 +
143 void *module_alloc(unsigned long size)
144 {
145 #ifdef MODULE_START
146 @@ -58,21 +169,68 @@ void *module_alloc(unsigned long size)
147
148 return __vmalloc_area(area, GFP_KERNEL, PAGE_KERNEL);
149 #else
150 + void *ptr;
151 +
152 if (size == 0)
153 return NULL;
154 - return vmalloc(size);
155 +
156 + ptr = alloc_phys(size);
157 +
158 + /* If we failed to allocate physically contiguous memory,
159 + * fall back to regular vmalloc. The module loader code will
160 + * create jump tables to handle long jumps */
161 + if (!ptr)
162 + return vmalloc(size);
163 +
164 + return ptr;
165 +#endif
166 +}
167 +
168 +static inline bool is_phys_addr(void *ptr)
169 +{
170 +#ifdef CONFIG_64BIT
171 + return (KSEGX((unsigned long)ptr) == CKSEG0);
172 +#else
173 + return (KSEGX(ptr) == KSEG0);
174 #endif
175 }
176
177 /* Free memory returned from module_alloc */
178 void module_free(struct module *mod, void *module_region)
179 {
180 - vfree(module_region);
181 + if (is_phys_addr(module_region)) {
182 + if (mod->module_init == module_region)
183 + free_phys(module_region, mod->init_size);
184 + else if (mod->module_core == module_region)
185 + free_phys(module_region, mod->core_size);
186 + else
187 + BUG();
188 + } else {
189 + vfree(module_region);
190 + }
191 }
192
193 int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
194 char *secstrings, struct module *mod)
195 {
196 + unsigned int symindex = 0;
197 + unsigned int core_size, init_size;
198 + int i;
199 +
200 + for (i = 1; i < hdr->e_shnum; i++)
201 + if (sechdrs[i].sh_type == SHT_SYMTAB)
202 + symindex = i;
203 +
204 + core_size = get_plt_size(hdr, sechdrs, secstrings, symindex, false);
205 + init_size = get_plt_size(hdr, sechdrs, secstrings, symindex, true);
206 +
207 + mod->arch.core_plt_offset = 0;
208 + mod->arch.core_plt_size = core_size;
209 + mod->arch.init_plt_offset = core_size;
210 + mod->arch.plt_tbl = kmalloc(core_size + init_size, GFP_KERNEL);
211 + if (!mod->arch.plt_tbl)
212 + return -ENOMEM;
213 +
214 return 0;
215 }
216
217 @@ -95,28 +253,40 @@ static int apply_r_mips_32_rela(struct m
218 return 0;
219 }
220
221 -static int apply_r_mips_26_rel(struct module *me, u32 *location, Elf_Addr v)
222 +static Elf_Addr add_plt_entry_to(unsigned *plt_offset,
223 + void *start, Elf_Addr v)
224 {
225 - if (v % 4) {
226 - pr_err("module %s: dangerous R_MIPS_26 REL relocation\n",
227 - me->name);
228 - return -ENOEXEC;
229 - }
230 + unsigned *tramp = start + *plt_offset;
231 + *plt_offset += 4 * sizeof(int);
232
233 - if ((v & 0xf0000000) != (((unsigned long)location + 4) & 0xf0000000)) {
234 - printk(KERN_ERR
235 - "module %s: relocation overflow\n",
236 - me->name);
237 - return -ENOEXEC;
238 - }
239 + /* adjust carry for addiu */
240 + if (v & 0x00008000)
241 + v += 0x10000;
242 +
243 + tramp[0] = 0x3c190000 | (v >> 16); /* lui t9, hi16 */
244 + tramp[1] = 0x27390000 | (v & 0xffff); /* addiu t9, t9, lo16 */
245 + tramp[2] = 0x03200008; /* jr t9 */
246 + tramp[3] = 0x00000000; /* nop */
247
248 - *location = (*location & ~0x03ffffff) |
249 - ((*location + (v >> 2)) & 0x03ffffff);
250 + return (Elf_Addr) tramp;
251 +}
252 +
253 +static Elf_Addr add_plt_entry(struct module *me, void *location, Elf_Addr v)
254 +{
255 + if (location >= me->module_core &&
256 + location < me->module_core + me->core_size)
257 + return add_plt_entry_to(&me->arch.core_plt_offset,
258 + me->arch.plt_tbl, v);
259 +
260 + if (location >= me->module_init &&
261 + location < me->module_init + me->init_size)
262 + return add_plt_entry_to(&me->arch.init_plt_offset,
263 + me->arch.plt_tbl, v);
264
265 return 0;
266 }
267
268 -static int apply_r_mips_26_rela(struct module *me, u32 *location, Elf_Addr v)
269 +static int set_r_mips_26(struct module *me, u32 *location, u32 ofs, Elf_Addr v)
270 {
271 if (v % 4) {
272 pr_err("module %s: dangerous R_MIPS_26 RELArelocation\n",
273 @@ -125,17 +295,31 @@ static int apply_r_mips_26_rela(struct m
274 }
275
276 if ((v & 0xf0000000) != (((unsigned long)location + 4) & 0xf0000000)) {
277 - printk(KERN_ERR
278 + v = add_plt_entry(me, location, v + (ofs << 2));
279 + if (!v) {
280 + printk(KERN_ERR
281 "module %s: relocation overflow\n",
282 me->name);
283 - return -ENOEXEC;
284 + return -ENOEXEC;
285 + }
286 + ofs = 0;
287 }
288
289 - *location = (*location & ~0x03ffffff) | ((v >> 2) & 0x03ffffff);
290 + *location = (*location & ~0x03ffffff) | ((ofs + (v >> 2)) & 0x03ffffff);
291
292 return 0;
293 }
294
295 +static int apply_r_mips_26_rel(struct module *me, u32 *location, Elf_Addr v)
296 +{
297 + return set_r_mips_26(me, location, *location & 0x03ffffff, v);
298 +}
299 +
300 +static int apply_r_mips_26_rela(struct module *me, u32 *location, Elf_Addr v)
301 +{
302 + return set_r_mips_26(me, location, 0, v);
303 +}
304 +
305 static int apply_r_mips_hi16_rel(struct module *me, u32 *location, Elf_Addr v)
306 {
307 struct mips_hi16 *n;
308 @@ -400,11 +584,23 @@ int module_finalize(const Elf_Ehdr *hdr,
309 list_add(&me->arch.dbe_list, &dbe_list);
310 spin_unlock_irq(&dbe_lock);
311 }
312 +
313 + /* Get rid of the fixup trampoline if we're running the module
314 + * from physically mapped address space */
315 + if (me->arch.core_plt_offset == 0 &&
316 + me->arch.init_plt_offset == me->arch.core_plt_size &&
317 + is_phys_addr(me->module_core)) {
318 + kfree(me->arch.plt_tbl);
319 + me->arch.plt_tbl = NULL;
320 + }
321 +
322 return 0;
323 }
324
325 void module_arch_cleanup(struct module *mod)
326 {
327 + if (mod->arch.plt_tbl)
328 + kfree(mod->arch.plt_tbl);
329 spin_lock_irq(&dbe_lock);
330 list_del(&mod->arch.dbe_list);
331 spin_unlock_irq(&dbe_lock);
This page took 0.056448 seconds and 5 git commands to generate.