[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Xen-devel] [PATCH for-4.9 v3 3/3] xen/livepatch: Don't crash on encountering STN_UNDEF relocations
Hi Andrew,
I am a bit confused, the title says "PATCH for-4.9 v3 3/3". I haven't
been CCed on the first two patches. Does it mean you are only looking at
this patch to be in 4.9?
Cheers,
On 22/06/17 19:15, Andrew Cooper wrote:
A symndx of STN_UNDEF is special, and means a symbol value of 0. While
legitimate in the ELF standard, its existance in a livepatch is questionable
at best. Until a plausible usecase presents itself, reject such a relocation
with -EOPNOTSUPP.
Additionally, fix an off-by-one error while range checking symndx, and perform
a safety check on elf->sym[symndx].sym before derefencing it, to avoid
tripping over a NULL pointer when calculating val.
Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
CC: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
CC: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
CC: Jan Beulich <JBeulich@xxxxxxxx>
CC: Stefano Stabellini <sstabellini@xxxxxxxxxx>
CC: Julien Grall <julien.grall@xxxxxxx>
v3:
* Fix off-by-one error
v2:
* Reject STN_UNDEF with -EOPNOTSUPP
---
xen/arch/arm/arm32/livepatch.c | 14 +++++++++++++-
xen/arch/arm/arm64/livepatch.c | 14 +++++++++++++-
xen/arch/x86/livepatch.c | 14 +++++++++++++-
3 files changed, 39 insertions(+), 3 deletions(-)
diff --git a/xen/arch/arm/arm32/livepatch.c b/xen/arch/arm/arm32/livepatch.c
index a328179..41378a5 100644
--- a/xen/arch/arm/arm32/livepatch.c
+++ b/xen/arch/arm/arm32/livepatch.c
@@ -254,12 +254,24 @@ int arch_livepatch_perform(struct livepatch_elf *elf,
addend = get_addend(type, dest);
}
- if ( symndx > elf->nsym )
+ if ( symndx == STN_UNDEF )
+ {
+ dprintk(XENLOG_ERR, LIVEPATCH "%s: Encountered STN_UNDEF\n",
+ elf->name);
+ return -EOPNOTSUPP;
+ }
+ else if ( symndx >= elf->nsym )
{
dprintk(XENLOG_ERR, LIVEPATCH "%s: Relative symbol wants symbol@%u
which is past end!\n",
elf->name, symndx);
return -EINVAL;
}
+ else if ( !elf->sym[symndx].sym )
+ {
+ dprintk(XENLOG_ERR, LIVEPATCH "%s: No relative symbol@%u\n",
+ elf->name, symndx);
+ return -EINVAL;
+ }
val = elf->sym[symndx].sym->st_value; /* S */
diff --git a/xen/arch/arm/arm64/livepatch.c b/xen/arch/arm/arm64/livepatch.c
index 63929b1..2247b92 100644
--- a/xen/arch/arm/arm64/livepatch.c
+++ b/xen/arch/arm/arm64/livepatch.c
@@ -252,12 +252,24 @@ int arch_livepatch_perform_rela(struct livepatch_elf *elf,
int ovf = 0;
uint64_t val;
- if ( symndx > elf->nsym )
+ if ( symndx == STN_UNDEF )
+ {
+ dprintk(XENLOG_ERR, LIVEPATCH "%s: Encountered STN_UNDEF\n",
+ elf->name);
+ return -EOPNOTSUPP;
+ }
+ else if ( symndx >= elf->nsym )
{
dprintk(XENLOG_ERR, LIVEPATCH "%s: Relative relocation wants symbol@%u
which is past end!\n",
elf->name, symndx);
return -EINVAL;
}
+ else if ( !elf->sym[symndx].sym )
+ {
+ dprintk(XENLOG_ERR, LIVEPATCH "%s: No relative symbol@%u\n",
+ elf->name, symndx);
+ return -EINVAL;
+ }
val = elf->sym[symndx].sym->st_value + r->r_addend; /* S+A */
diff --git a/xen/arch/x86/livepatch.c b/xen/arch/x86/livepatch.c
index 7917610..406eb91 100644
--- a/xen/arch/x86/livepatch.c
+++ b/xen/arch/x86/livepatch.c
@@ -170,12 +170,24 @@ int arch_livepatch_perform_rela(struct livepatch_elf *elf,
uint8_t *dest = base->load_addr + r->r_offset;
uint64_t val;
- if ( symndx > elf->nsym )
+ if ( symndx == STN_UNDEF )
+ {
+ dprintk(XENLOG_ERR, LIVEPATCH "%s: Encountered STN_UNDEF\n",
+ elf->name);
+ return -EOPNOTSUPP;
+ }
+ else if ( symndx >= elf->nsym )
{
dprintk(XENLOG_ERR, LIVEPATCH "%s: Relative relocation wants symbol@%u
which is past end!\n",
elf->name, symndx);
return -EINVAL;
}
+ else if ( !elf->sym[symndx].sym )
+ {
+ dprintk(XENLOG_ERR, LIVEPATCH "%s: No symbol@%u\n",
+ elf->name, symndx);
+ return -EINVAL;
+ }
val = r->r_addend + elf->sym[symndx].sym->st_value;
--
Julien Grall
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel
|
