Re: [Xen-devel] [PATCH v8.1 26/27] xsplice: Prevent duplicate payloads from being loaded.

["Jan Beulich" <jbeulich@xxxxxxxx>]

>>> Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx> 04/14/16 12:03 AM >>>
>--- a/xen/common/xsplice.c
>+++ b/xen/common/xsplice.c
>@@ -517,6 +517,8 @@ static int prepare_payload(struct payload *payload,
     >sec = xsplice_elf_sec_by_name(elf, ".note.gnu.build-id");
     >if ( sec )
     >{
>+        struct payload *data;

And I guess you can guess it: const.

>@@ -528,6 +530,20 @@ static int prepare_payload(struct payload *payload,
 >
         >if ( !payload->id.len || !payload->id.p )
             >return -EINVAL;
>+
>+        /* Make sure it is not a duplicate. */
>+        list_for_each_entry ( data, &payload_list, list )
>+        {
>+            /* No way _this_ payload is on the list. */
>+            ASSERT(data != payload);
>+            if ( data->id.len &&

Checking for zero on a _loaded_ module seems pointless now that you
require build IDs. Independent of that you anyway need

data->id.len != payload->id.len ||

>+                 !memcmp(data->id.p, payload->id.p, data->id.len) )

Or else this is possibly accessing out of bounds data.

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel