147 lines
		
	
	
	
		
			4.9 KiB
			
		
	
	
	
		
			Bash
		
	
	
	
	
	
		
		
			
		
	
	
			147 lines
		
	
	
	
		
			4.9 KiB
			
		
	
	
	
		
			Bash
		
	
	
	
	
	
|   | #! /bin/bash
 | ||
|  | # (c) 2015, Quentin Casasnovas <quentin.casasnovas@oracle.com> | ||
|  | 
 | ||
|  | obj=$1 | ||
|  | 
 | ||
|  | file ${obj} | grep -q ELF || (echo "${obj} is not and ELF file." 1>&2 ; exit 0) | ||
|  | 
 | ||
|  | # Bail out early if there isn't an __ex_table section in this object file. | ||
|  | objdump -hj __ex_table ${obj} 2> /dev/null > /dev/null | ||
|  | [ $? -ne 0 ] && exit 0 | ||
|  | 
 | ||
|  | white_list=.text,.fixup | ||
|  | 
 | ||
|  | suspicious_relocs=$(objdump -rj __ex_table ${obj}  | tail -n +6 | | ||
|  | 			grep -v $(eval echo -e{${white_list}}) | awk '{print $3}') | ||
|  | 
 | ||
|  | # No suspicious relocs in __ex_table, jobs a good'un | ||
|  | [ -z "${suspicious_relocs}" ] && exit 0 | ||
|  | 
 | ||
|  | 
 | ||
|  | # After this point, something is seriously wrong since we just found out we | ||
|  | # have some relocations in __ex_table which point to sections which aren't | ||
|  | # white listed.  If you're adding a new section in the Linux kernel, and | ||
|  | # you're expecting this section to contain code which can fault (i.e. the | ||
|  | # __ex_table relocation to your new section is expected), simply add your | ||
|  | # new section to the white_list variable above.  If not, you're probably | ||
|  | # doing something wrong and the rest of this code is just trying to print | ||
|  | # you more information about it. | ||
|  | 
 | ||
|  | function find_section_offset_from_symbol() | ||
|  | { | ||
|  |     eval $(objdump -t ${obj} | grep ${1} | sed 's/\([0-9a-f]\+\) .\{7\} \([^ \t]\+\).*/section="\2"; section_offset="0x\1" /') | ||
|  | 
 | ||
|  |     # addr2line takes addresses in hexadecimal... | ||
|  |     section_offset=$(printf "0x%016x" $(( ${section_offset} + $2 )) ) | ||
|  | } | ||
|  | 
 | ||
|  | function find_symbol_and_offset_from_reloc() | ||
|  | { | ||
|  |     # Extract symbol and offset from the objdump output | ||
|  |     eval $(echo $reloc | sed 's/\([^+]\+\)+\?\(0x[0-9a-f]\+\)\?/symbol="\1"; symbol_offset="\2"/') | ||
|  | 
 | ||
|  |     # When the relocation points to the begining of a symbol or section, it | ||
|  |     # won't print the offset since it is zero. | ||
|  |     if [ -z "${symbol_offset}" ]; then | ||
|  | 	symbol_offset=0x0 | ||
|  |     fi | ||
|  | } | ||
|  | 
 | ||
|  | function find_alt_replacement_target() | ||
|  | { | ||
|  |     # The target of the .altinstr_replacement is the relocation just before | ||
|  |     # the .altinstr_replacement one. | ||
|  |     eval $(objdump -rj .altinstructions ${obj} | grep -B1 "${section}+${section_offset}" | head -n1 | awk '{print $3}' | | ||
|  | 	   sed 's/\([^+]\+\)+\(0x[0-9a-f]\+\)/alt_target_section="\1"; alt_target_offset="\2"/') | ||
|  | } | ||
|  | 
 | ||
|  | function handle_alt_replacement_reloc() | ||
|  | { | ||
|  |     # This will define alt_target_section and alt_target_section_offset | ||
|  |     find_alt_replacement_target ${section} ${section_offset} | ||
|  | 
 | ||
|  |     echo "Error: found a reference to .altinstr_replacement in __ex_table:" | ||
|  |     addr2line -fip -j ${alt_target_section} -e ${obj} ${alt_target_offset} | awk '{print "\t" $0}' | ||
|  | 
 | ||
|  |     error=true | ||
|  | } | ||
|  | 
 | ||
|  | function is_executable_section() | ||
|  | { | ||
|  |     objdump -hwj ${section} ${obj} | grep -q CODE | ||
|  |     return $? | ||
|  | } | ||
|  | 
 | ||
|  | function handle_suspicious_generic_reloc() | ||
|  | { | ||
|  |     if is_executable_section ${section}; then | ||
|  | 	# We've got a relocation to a non white listed _executable_ | ||
|  | 	# section, print a warning so the developper adds the section to | ||
|  | 	# the white list or fix his code.  We try to pretty-print the file | ||
|  | 	# and line number where that relocation was added. | ||
|  | 	echo "Warning: found a reference to section \"${section}\" in __ex_table:" | ||
|  | 	addr2line -fip -j ${section} -e ${obj} ${section_offset} | awk '{print "\t" $0}' | ||
|  |     else | ||
|  | 	# Something is definitively wrong here since we've got a relocation | ||
|  | 	# to a non-executable section, there's no way this would ever be | ||
|  | 	# running in the kernel. | ||
|  | 	echo "Error: found a reference to non-executable section \"${section}\" in __ex_table at offset ${section_offset}" | ||
|  | 	error=true | ||
|  |     fi | ||
|  | } | ||
|  | 
 | ||
|  | function handle_suspicious_reloc() | ||
|  | { | ||
|  |     case "${section}" in | ||
|  | 	".altinstr_replacement") | ||
|  | 	    handle_alt_replacement_reloc ${section} ${section_offset} | ||
|  | 	    ;; | ||
|  | 	*) | ||
|  | 	    handle_suspicious_generic_reloc ${section} ${section_offset} | ||
|  | 	    ;; | ||
|  |     esac | ||
|  | } | ||
|  | 
 | ||
|  | function diagnose() | ||
|  | { | ||
|  | 
 | ||
|  |     for reloc in ${suspicious_relocs}; do | ||
|  | 	# Let's find out where the target of the relocation in __ex_table | ||
|  | 	# is, this will define ${symbol} and ${symbol_offset} | ||
|  | 	find_symbol_and_offset_from_reloc ${reloc} | ||
|  | 
 | ||
|  | 	# When there's a global symbol at the place of the relocation, | ||
|  | 	# objdump will use it instead of giving us a section+offset, so | ||
|  | 	# let's find out which section is this symbol in and the total | ||
|  | 	# offset withing that section. | ||
|  | 	find_section_offset_from_symbol ${symbol} ${symbol_offset} | ||
|  | 
 | ||
|  | 	# In this case objdump was presenting us with a reloc to a symbol | ||
|  | 	# rather than a section. Now that we've got the actual section, | ||
|  | 	# we can skip it if it's in the white_list. | ||
|  | 	if [ -z "$( echo $section | grep -v $(eval echo -e{${white_list}}))" ]; then | ||
|  | 	    continue; | ||
|  | 	fi | ||
|  | 
 | ||
|  | 	# Will either print a warning if the relocation happens to be in a | ||
|  | 	# section we do not know but has executable bit set, or error out. | ||
|  | 	handle_suspicious_reloc | ||
|  |     done | ||
|  | } | ||
|  | 
 | ||
|  | function check_debug_info() { | ||
|  |     objdump -hj .debug_info ${obj} 2> /dev/null > /dev/null || | ||
|  | 	echo -e "${obj} does not contain debug information, the addr2line output will be limited.\n" \
 | ||
|  | 	     "Recompile ${obj} with CONFIG_DEBUG_INFO to get a more useful output." | ||
|  | } | ||
|  | 
 | ||
|  | check_debug_info | ||
|  | 
 | ||
|  | diagnose | ||
|  | 
 | ||
|  | if [ "${error}" ]; then | ||
|  |     exit 1 | ||
|  | fi | ||
|  | 
 | ||
|  | exit 0 |