[Xen-changelog] [xen stable-4.8] xen/livepatch: Don't crash on encountering STN_UNDEF relocations

[patchbot@xxxxxxx]

commit 3ef997c8beea6ebf4e9816a78c02548d7e845968
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Mon Aug 28 11:45:45 2017 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Aug 28 11:45:45 2017 +0200

    xen/livepatch: Don't crash on encountering STN_UNDEF relocations
    
    A symndx of STN_UNDEF is special, and means a symbol value of 0.  While
    legitimate in the ELF standard, its existance in a livepatch is questionable
    at best.  Until a plausible usecase presents itself, reject such a 
relocation
    with -EOPNOTSUPP.
    
    Additionally, fix an off-by-one error while range checking symndx, and 
perform
    a safety check on elf->sym[symndx].sym before derefencing it, to avoid
    tripping over a NULL pointer when calculating val.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
    Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx> [x86 and arm32]
    Reviewed-by: Jan Beulich <JBeulich@xxxxxxxx>
    Reviewed-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
    master commit: 2ff229643b739e2fd0cd0536ee9fca506cfa92f8
    master date: 2017-06-23 15:00:37 +0100
---
 xen/arch/arm/arm32/livepatch.c | 14 +++++++++++++-
 xen/arch/arm/arm64/livepatch.c | 14 +++++++++++++-
 xen/arch/x86/livepatch.c       | 14 +++++++++++++-
 3 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/xen/arch/arm/arm32/livepatch.c b/xen/arch/arm/arm32/livepatch.c
index a7fd5e2..d401ccc 100644
--- a/xen/arch/arm/arm32/livepatch.c
+++ b/xen/arch/arm/arm32/livepatch.c
@@ -252,12 +252,24 @@ int arch_livepatch_perform(struct livepatch_elf *elf,
             dest = base->load_addr + r->r_offset; /* P */
         }
 
-        if ( symndx > elf->nsym )
+        if ( symndx == STN_UNDEF )
+        {
+            dprintk(XENLOG_ERR, LIVEPATCH "%s: Encountered STN_UNDEF\n",
+                    elf->name);
+            return -EOPNOTSUPP;
+        }
+        else if ( symndx >= elf->nsym )
         {
             dprintk(XENLOG_ERR, LIVEPATCH "%s: Relative symbol wants symbol@%u 
which is past end!\n",
                     elf->name, symndx);
             return -EINVAL;
         }
+        else if ( !elf->sym[symndx].sym )
+        {
+            dprintk(XENLOG_ERR, LIVEPATCH "%s: No relative symbol@%u\n",
+                    elf->name, symndx);
+            return -EINVAL;
+        }
 
         if ( !use_rela )
             addend = get_addend(type, dest);
diff --git a/xen/arch/arm/arm64/livepatch.c b/xen/arch/arm/arm64/livepatch.c
index dae64f5..46301c3 100644
--- a/xen/arch/arm/arm64/livepatch.c
+++ b/xen/arch/arm/arm64/livepatch.c
@@ -255,12 +255,24 @@ int arch_livepatch_perform_rela(struct livepatch_elf *elf,
 
         symndx = ELF64_R_SYM(r->r_info);
 
-        if ( symndx > elf->nsym )
+        if ( symndx == STN_UNDEF )
+        {
+            dprintk(XENLOG_ERR, LIVEPATCH "%s: Encountered STN_UNDEF\n",
+                    elf->name);
+            return -EOPNOTSUPP;
+        }
+        else if ( symndx >= elf->nsym )
         {
             dprintk(XENLOG_ERR, LIVEPATCH "%s: Relative relocation wants 
symbol@%u which is past end!\n",
                     elf->name, symndx);
             return -EINVAL;
         }
+        else if ( !elf->sym[symndx].sym )
+        {
+            dprintk(XENLOG_ERR, LIVEPATCH "%s: No relative symbol@%u\n",
+                    elf->name, symndx);
+            return -EINVAL;
+        }
 
         dest = base->load_addr + r->r_offset; /* P */
         val = elf->sym[symndx].sym->st_value +  r->r_addend; /* S+A */
diff --git a/xen/arch/x86/livepatch.c b/xen/arch/x86/livepatch.c
index 9663ef6..dc27fdd 100644
--- a/xen/arch/x86/livepatch.c
+++ b/xen/arch/x86/livepatch.c
@@ -162,12 +162,24 @@ int arch_livepatch_perform_rela(struct livepatch_elf *elf,
 
         symndx = ELF64_R_SYM(r->r_info);
 
-        if ( symndx > elf->nsym )
+        if ( symndx == STN_UNDEF )
+        {
+            dprintk(XENLOG_ERR, LIVEPATCH "%s: Encountered STN_UNDEF\n",
+                    elf->name);
+            return -EOPNOTSUPP;
+        }
+        else if ( symndx >= elf->nsym )
         {
             dprintk(XENLOG_ERR, LIVEPATCH "%s: Relative relocation wants 
symbol@%u which is past end!\n",
                     elf->name, symndx);
             return -EINVAL;
         }
+        else if ( !elf->sym[symndx].sym )
+        {
+            dprintk(XENLOG_ERR, LIVEPATCH "%s: No symbol@%u\n",
+                    elf->name, symndx);
+            return -EINVAL;
+        }
 
         dest = base->load_addr + r->r_offset;
         val = r->r_addend + elf->sym[symndx].sym->st_value;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.8

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog