All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 0/2] livepatch: fix handling of (some) relocations
@ 2022-03-17 11:08 Roger Pau Monne
  2022-03-17 11:08 ` [PATCH 1/2] livepatch: do not ignore sections with 0 size Roger Pau Monne
                   ` (2 more replies)
  0 siblings, 3 replies; 14+ messages in thread
From: Roger Pau Monne @ 2022-03-17 11:08 UTC (permalink / raw)
  To: xen-devel
  Cc: Roger Pau Monne, Konrad Rzeszutek Wilk, Ross Lagerwall,
	Stefano Stabellini, Julien Grall, Bertrand Marquis,
	Volodymyr Babchuk, Jan Beulich, Andrew Cooper, Wei Liu

Hello,

Relocations that reference symbols that belong to sections with a size
of 0 are not properly resolved, as the address of those symbols won't be
resolved in the first place.

Fix this by not ignoring sections with a size of 0, while still properly
handling the detection of whether a livepatch can be reapplied after
being reverted (patch 1).

Also detect whether any relocations reference unresolved symbols and
error out in that case, as those relocations cannot be resolved (patch
2).

I wonder whether it's possible to have unresolved symbols if we only
ignore non SHF_ALLOC sections, so we could maybe error out earlier if we
found a symbols that belongs to a non SHF_ALLOC section in
livepatch_elf_resolve_symbols.  The current approach is more conservative
as we would only report an error if we have unresolved symbols that are
referenced in relocations.

Thanks, Roger.

Roger Pau Monne (2):
  livepatch: do not ignore sections with 0 size
  livepatch: avoid relocations referencing ignored section symbols

 xen/arch/arm/arm32/livepatch.c  |  7 +++++++
 xen/arch/arm/arm64/livepatch.c  |  7 +++++++
 xen/arch/x86/livepatch.c        |  7 +++++++
 xen/common/livepatch.c          | 16 +++++++++++-----
 xen/common/livepatch_elf.c      |  6 ++++++
 xen/include/xen/livepatch_elf.h |  3 ++-
 6 files changed, 40 insertions(+), 6 deletions(-)

-- 
2.34.1



^ permalink raw reply	[flat|nested] 14+ messages in thread

* [PATCH 1/2] livepatch: do not ignore sections with 0 size
  2022-03-17 11:08 [PATCH 0/2] livepatch: fix handling of (some) relocations Roger Pau Monne
@ 2022-03-17 11:08 ` Roger Pau Monne
  2022-03-17 14:00   ` Andrew Cooper
                     ` (2 more replies)
  2022-03-17 11:08 ` [PATCH 2/2] livepatch: avoid relocations referencing ignored section symbols Roger Pau Monne
  2022-03-17 13:18 ` [PATCH 0/2] livepatch: fix handling of (some) relocations Jan Beulich
  2 siblings, 3 replies; 14+ messages in thread
From: Roger Pau Monne @ 2022-03-17 11:08 UTC (permalink / raw)
  To: xen-devel; +Cc: Roger Pau Monne, Konrad Rzeszutek Wilk, Ross Lagerwall

A side effect of ignoring such sections is that symbols belonging to
them won't be resolved, and that could make relocations belonging to
other sections that reference those symbols fail.

For example it's likely to have an empty .altinstr_replacement with
symbols pointing to it, and marking the section as ignored will
prevent the symbols from being resolved, which in turn will cause any
relocations against them to fail.

In order to solve this do not ignore sections with 0 size, only ignore
sections that don't have the SHF_ALLOC flag set.

Special case such empty sections in move_payload so they are not taken
into account in order to decide whether a livepatch can be safely
re-applied after a revert.

Fixes: 98b728a7b2 ('livepatch: Disallow applying after an revert')
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
---
 xen/common/livepatch.c          | 16 +++++++++++-----
 xen/include/xen/livepatch_elf.h |  2 +-
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/xen/common/livepatch.c b/xen/common/livepatch.c
index be2cf75c2d..abc1cae136 100644
--- a/xen/common/livepatch.c
+++ b/xen/common/livepatch.c
@@ -300,9 +300,6 @@ static int move_payload(struct payload *payload, struct livepatch_elf *elf)
          * and .shstrtab. For the non-relocate we allocate and copy these
          * via other means - and the .rel we can ignore as we only use it
          * once during loading.
-         *
-         * Also ignore sections with zero size. Those can be for example:
-         * data, or .bss.
          */
         if ( livepatch_elf_ignore_section(elf->sec[i].sec) )
             offset[i] = UINT_MAX;
@@ -361,8 +358,17 @@ static int move_payload(struct payload *payload, struct livepatch_elf *elf)
             else if ( elf->sec[i].sec->sh_flags & SHF_WRITE )
             {
                 buf = rw_buf;
-                rw_buf_sec = i;
-                rw_buf_cnt++;
+                if ( elf->sec[i].sec->sh_size )
+                {
+                    /*
+                     * Special handling of RW empty regions: do not account for
+                     * them in order to decide whether a patch can safely be
+                     * re-applied, but assign them a load address so symbol
+                     * resolution and relocations work.
+                     */
+                    rw_buf_sec = i;
+                    rw_buf_cnt++;
+                }
             }
             else
                 buf = ro_buf;
diff --git a/xen/include/xen/livepatch_elf.h b/xen/include/xen/livepatch_elf.h
index 9ad499ee8b..5b1ec469da 100644
--- a/xen/include/xen/livepatch_elf.h
+++ b/xen/include/xen/livepatch_elf.h
@@ -48,7 +48,7 @@ int livepatch_elf_perform_relocs(struct livepatch_elf *elf);
 
 static inline bool livepatch_elf_ignore_section(const Elf_Shdr *sec)
 {
-    return !(sec->sh_flags & SHF_ALLOC) || sec->sh_size == 0;
+    return !(sec->sh_flags & SHF_ALLOC);
 }
 #endif /* __XEN_LIVEPATCH_ELF_H__ */
 
-- 
2.34.1



^ permalink raw reply related	[flat|nested] 14+ messages in thread

* [PATCH 2/2] livepatch: avoid relocations referencing ignored section symbols
  2022-03-17 11:08 [PATCH 0/2] livepatch: fix handling of (some) relocations Roger Pau Monne
  2022-03-17 11:08 ` [PATCH 1/2] livepatch: do not ignore sections with 0 size Roger Pau Monne
@ 2022-03-17 11:08 ` Roger Pau Monne
  2022-03-17 13:26   ` Jan Beulich
  2022-04-07 16:22   ` Ross Lagerwall
  2022-03-17 13:18 ` [PATCH 0/2] livepatch: fix handling of (some) relocations Jan Beulich
  2 siblings, 2 replies; 14+ messages in thread
From: Roger Pau Monne @ 2022-03-17 11:08 UTC (permalink / raw)
  To: xen-devel
  Cc: Roger Pau Monne, Konrad Rzeszutek Wilk, Ross Lagerwall,
	Stefano Stabellini, Julien Grall, Bertrand Marquis,
	Volodymyr Babchuk, Jan Beulich, Andrew Cooper, Wei Liu

Track whether symbols belong to ignored sections in order to avoid
applying relocations referencing those symbols. The address of such
symbols won't be resolved and thus the relocation will likely fail or
write garbage to the destination.

Return an error in that case, as leaving unresolved relocations would
lead to malfunctioning payload code.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
---
 xen/arch/arm/arm32/livepatch.c  | 7 +++++++
 xen/arch/arm/arm64/livepatch.c  | 7 +++++++
 xen/arch/x86/livepatch.c        | 7 +++++++
 xen/common/livepatch_elf.c      | 6 ++++++
 xen/include/xen/livepatch_elf.h | 1 +
 5 files changed, 28 insertions(+)

diff --git a/xen/arch/arm/arm32/livepatch.c b/xen/arch/arm/arm32/livepatch.c
index 5a06467008..6aed227818 100644
--- a/xen/arch/arm/arm32/livepatch.c
+++ b/xen/arch/arm/arm32/livepatch.c
@@ -272,6 +272,13 @@ int arch_livepatch_perform(struct livepatch_elf *elf,
                    elf->name, symndx);
             return -EINVAL;
         }
+        else if ( elf->sym[symndx].ignored )
+        {
+            printk(XENLOG_ERR LIVEPATCH
+                    "%s: Relocation against ignored symbol %s cannot be resolved\n",
+                    elf->name, elf->sym[symndx].name);
+            return -EINVAL;
+        }
 
         val = elf->sym[symndx].sym->st_value; /* S */
 
diff --git a/xen/arch/arm/arm64/livepatch.c b/xen/arch/arm/arm64/livepatch.c
index 6ec8dc60f0..655ded33d2 100644
--- a/xen/arch/arm/arm64/livepatch.c
+++ b/xen/arch/arm/arm64/livepatch.c
@@ -270,6 +270,13 @@ int arch_livepatch_perform_rela(struct livepatch_elf *elf,
                    elf->name, symndx);
             return -EINVAL;
         }
+        else if ( elf->sym[symndx].ignored )
+        {
+            printk(XENLOG_ERR LIVEPATCH
+                    "%s: Relocation against ignored symbol %s cannot be resolved\n",
+                    elf->name, elf->sym[symndx].name);
+            return -EINVAL;
+        }
 
         val = elf->sym[symndx].sym->st_value +  r->r_addend; /* S+A */
 
diff --git a/xen/arch/x86/livepatch.c b/xen/arch/x86/livepatch.c
index 37c9b8435e..a928e5bfcd 100644
--- a/xen/arch/x86/livepatch.c
+++ b/xen/arch/x86/livepatch.c
@@ -262,6 +262,13 @@ int arch_livepatch_perform_rela(struct livepatch_elf *elf,
                    elf->name, symndx);
             return -EINVAL;
         }
+        else if ( elf->sym[symndx].ignored )
+        {
+            printk(XENLOG_ERR LIVEPATCH
+                    "%s: Relocation against ignored symbol %s cannot be resolved\n",
+                    elf->name, elf->sym[symndx].name);
+            return -EINVAL;
+        }
 
         val = r->r_addend + elf->sym[symndx].sym->st_value;
 
diff --git a/xen/common/livepatch_elf.c b/xen/common/livepatch_elf.c
index b089cacb1c..45d73912a3 100644
--- a/xen/common/livepatch_elf.c
+++ b/xen/common/livepatch_elf.c
@@ -334,7 +334,13 @@ int livepatch_elf_resolve_symbols(struct livepatch_elf *elf)
             }
 
             if ( livepatch_elf_ignore_section(elf->sec[idx].sec) )
+            {
+                dprintk(XENLOG_DEBUG, LIVEPATCH
+                        "%s: Symbol %s from section %s ignored\n",
+                        elf->name, elf->sym[i].name, elf->sec[idx].name);
+                elf->sym[i].ignored = true;
                 break;
+            }
 
             st_value += (unsigned long)elf->sec[idx].load_addr;
             if ( elf->sym[i].name )
diff --git a/xen/include/xen/livepatch_elf.h b/xen/include/xen/livepatch_elf.h
index 5b1ec469da..7116deaddc 100644
--- a/xen/include/xen/livepatch_elf.h
+++ b/xen/include/xen/livepatch_elf.h
@@ -22,6 +22,7 @@ struct livepatch_elf_sec {
 struct livepatch_elf_sym {
     const Elf_Sym *sym;
     const char *name;
+    bool ignored;
 };
 
 struct livepatch_elf {
-- 
2.34.1



^ permalink raw reply related	[flat|nested] 14+ messages in thread

* Re: [PATCH 0/2] livepatch: fix handling of (some) relocations
  2022-03-17 11:08 [PATCH 0/2] livepatch: fix handling of (some) relocations Roger Pau Monne
  2022-03-17 11:08 ` [PATCH 1/2] livepatch: do not ignore sections with 0 size Roger Pau Monne
  2022-03-17 11:08 ` [PATCH 2/2] livepatch: avoid relocations referencing ignored section symbols Roger Pau Monne
@ 2022-03-17 13:18 ` Jan Beulich
  2 siblings, 0 replies; 14+ messages in thread
From: Jan Beulich @ 2022-03-17 13:18 UTC (permalink / raw)
  To: Roger Pau Monne
  Cc: Konrad Rzeszutek Wilk, Ross Lagerwall, Stefano Stabellini,
	Julien Grall, Bertrand Marquis, Volodymyr Babchuk, Andrew Cooper,
	Wei Liu, xen-devel

On 17.03.2022 12:08, Roger Pau Monne wrote:
> I wonder whether it's possible to have unresolved symbols if we only
> ignore non SHF_ALLOC sections, so we could maybe error out earlier if we
> found a symbols that belongs to a non SHF_ALLOC section in
> livepatch_elf_resolve_symbols.  The current approach is more conservative
> as we would only report an error if we have unresolved symbols that are
> referenced in relocations.

I think it's better to remain that way. Symbols appearing in non-alloc
sections isn't wrong in any way, as long - as you say - there's no
relocation using them.

Jan



^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH 2/2] livepatch: avoid relocations referencing ignored section symbols
  2022-03-17 11:08 ` [PATCH 2/2] livepatch: avoid relocations referencing ignored section symbols Roger Pau Monne
@ 2022-03-17 13:26   ` Jan Beulich
  2022-03-17 13:50     ` Roger Pau Monné
  2022-04-07 16:22   ` Ross Lagerwall
  1 sibling, 1 reply; 14+ messages in thread
From: Jan Beulich @ 2022-03-17 13:26 UTC (permalink / raw)
  To: Roger Pau Monne
  Cc: Konrad Rzeszutek Wilk, Ross Lagerwall, Stefano Stabellini,
	Julien Grall, Bertrand Marquis, Volodymyr Babchuk, Andrew Cooper,
	Wei Liu, xen-devel

On 17.03.2022 12:08, Roger Pau Monne wrote:
> Track whether symbols belong to ignored sections in order to avoid
> applying relocations referencing those symbols. The address of such
> symbols won't be resolved and thus the relocation will likely fail or
> write garbage to the destination.
> 
> Return an error in that case, as leaving unresolved relocations would
> lead to malfunctioning payload code.
> 
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>

Reviewed-by: Jan Beulich <jbeulich@suse.com>
with one nit (which can likely be addressed while committing):

> --- a/xen/arch/arm/arm32/livepatch.c
> +++ b/xen/arch/arm/arm32/livepatch.c
> @@ -272,6 +272,13 @@ int arch_livepatch_perform(struct livepatch_elf *elf,
>                     elf->name, symndx);
>              return -EINVAL;
>          }
> +        else if ( elf->sym[symndx].ignored )
> +        {
> +            printk(XENLOG_ERR LIVEPATCH
> +                    "%s: Relocation against ignored symbol %s cannot be resolved\n",
> +                    elf->name, elf->sym[symndx].name);

Indentation here (and in the other two instances mirroring this)
is off by one.

Jan



^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH 2/2] livepatch: avoid relocations referencing ignored section symbols
  2022-03-17 13:26   ` Jan Beulich
@ 2022-03-17 13:50     ` Roger Pau Monné
  0 siblings, 0 replies; 14+ messages in thread
From: Roger Pau Monné @ 2022-03-17 13:50 UTC (permalink / raw)
  To: Jan Beulich
  Cc: Konrad Rzeszutek Wilk, Ross Lagerwall, Stefano Stabellini,
	Julien Grall, Bertrand Marquis, Volodymyr Babchuk, Andrew Cooper,
	Wei Liu, xen-devel

On Thu, Mar 17, 2022 at 02:26:50PM +0100, Jan Beulich wrote:
> On 17.03.2022 12:08, Roger Pau Monne wrote:
> > Track whether symbols belong to ignored sections in order to avoid
> > applying relocations referencing those symbols. The address of such
> > symbols won't be resolved and thus the relocation will likely fail or
> > write garbage to the destination.
> > 
> > Return an error in that case, as leaving unresolved relocations would
> > lead to malfunctioning payload code.
> > 
> > Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
> 
> Reviewed-by: Jan Beulich <jbeulich@suse.com>
> with one nit (which can likely be addressed while committing):
> 
> > --- a/xen/arch/arm/arm32/livepatch.c
> > +++ b/xen/arch/arm/arm32/livepatch.c
> > @@ -272,6 +272,13 @@ int arch_livepatch_perform(struct livepatch_elf *elf,
> >                     elf->name, symndx);
> >              return -EINVAL;
> >          }
> > +        else if ( elf->sym[symndx].ignored )
> > +        {
> > +            printk(XENLOG_ERR LIVEPATCH
> > +                    "%s: Relocation against ignored symbol %s cannot be resolved\n",
> > +                    elf->name, elf->sym[symndx].name);
> 
> Indentation here (and in the other two instances mirroring this)
> is off by one.

Oh, thanks, sorry for not noticing.

Roger.


^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH 1/2] livepatch: do not ignore sections with 0 size
  2022-03-17 11:08 ` [PATCH 1/2] livepatch: do not ignore sections with 0 size Roger Pau Monne
@ 2022-03-17 14:00   ` Andrew Cooper
  2022-03-17 14:09     ` Jan Beulich
  2022-03-17 14:16     ` Roger Pau Monné
  2022-03-25 14:05   ` Roger Pau Monné
  2022-04-07 16:16   ` Ross Lagerwall
  2 siblings, 2 replies; 14+ messages in thread
From: Andrew Cooper @ 2022-03-17 14:00 UTC (permalink / raw)
  To: Roger Pau Monne, xen-devel; +Cc: Konrad Rzeszutek Wilk, Ross Lagerwall

On 17/03/2022 11:08, Roger Pau Monne wrote:
> A side effect of ignoring such sections is that symbols belonging to
> them won't be resolved, and that could make relocations belonging to
> other sections that reference those symbols fail.
>
> For example it's likely to have an empty .altinstr_replacement with
> symbols pointing to it, and marking the section as ignored will
> prevent the symbols from being resolved, which in turn will cause any
> relocations against them to fail.

I agree this is a bug in livepatch handling, but it's also an error in
the generated livepatch.  We should not have relocations to an empty
altinstr_replacement section in the first place.

This will probably be from the lfences, where the replacement in a nop
and takes no space.  I think I know how to fix this case.

~Andrew

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH 1/2] livepatch: do not ignore sections with 0 size
  2022-03-17 14:00   ` Andrew Cooper
@ 2022-03-17 14:09     ` Jan Beulich
  2022-03-17 14:16     ` Roger Pau Monné
  1 sibling, 0 replies; 14+ messages in thread
From: Jan Beulich @ 2022-03-17 14:09 UTC (permalink / raw)
  To: Andrew Cooper
  Cc: Konrad Rzeszutek Wilk, Ross Lagerwall, Roger Pau Monne, xen-devel

On 17.03.2022 15:00, Andrew Cooper wrote:
> On 17/03/2022 11:08, Roger Pau Monne wrote:
>> A side effect of ignoring such sections is that symbols belonging to
>> them won't be resolved, and that could make relocations belonging to
>> other sections that reference those symbols fail.
>>
>> For example it's likely to have an empty .altinstr_replacement with
>> symbols pointing to it, and marking the section as ignored will
>> prevent the symbols from being resolved, which in turn will cause any
>> relocations against them to fail.
> 
> I agree this is a bug in livepatch handling, but it's also an error in
> the generated livepatch.  We should not have relocations to an empty
> altinstr_replacement section in the first place.

I think having such relocations is quite natural, but ...

> This will probably be from the lfences, where the replacement in a nop
> and takes no space.  I think I know how to fix this case.

... of course it's possible to eliminate them. Whether that's worthwhile
to add logic for I'm not sure.

Jan



^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH 1/2] livepatch: do not ignore sections with 0 size
  2022-03-17 14:00   ` Andrew Cooper
  2022-03-17 14:09     ` Jan Beulich
@ 2022-03-17 14:16     ` Roger Pau Monné
  2022-03-17 14:25       ` Andrew Cooper
  1 sibling, 1 reply; 14+ messages in thread
From: Roger Pau Monné @ 2022-03-17 14:16 UTC (permalink / raw)
  To: Andrew Cooper; +Cc: xen-devel, Konrad Rzeszutek Wilk, Ross Lagerwall

On Thu, Mar 17, 2022 at 02:00:19PM +0000, Andrew Cooper wrote:
> On 17/03/2022 11:08, Roger Pau Monne wrote:
> > A side effect of ignoring such sections is that symbols belonging to
> > them won't be resolved, and that could make relocations belonging to
> > other sections that reference those symbols fail.
> >
> > For example it's likely to have an empty .altinstr_replacement with
> > symbols pointing to it, and marking the section as ignored will
> > prevent the symbols from being resolved, which in turn will cause any
> > relocations against them to fail.
> 
> I agree this is a bug in livepatch handling, but it's also an error in
> the generated livepatch.  We should not have relocations to an empty
> altinstr_replacement section in the first place.

Well, the relocation destination is in the .altinstructions section
(which is not empty). It happens however to reference a symbol that
points to the .altinstr_replacement section that's empty.

We could likely avoid generating the altinstr_replacement section in
the first place, but I think it's more robust to handle those properly
in the elf loading code.

> This will probably be from the lfences, where the replacement in a nop
> and takes no space.  I think I know how to fix this case.

Indeed, that's my understanding.

Thanks, Roger.


^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH 1/2] livepatch: do not ignore sections with 0 size
  2022-03-17 14:16     ` Roger Pau Monné
@ 2022-03-17 14:25       ` Andrew Cooper
  0 siblings, 0 replies; 14+ messages in thread
From: Andrew Cooper @ 2022-03-17 14:25 UTC (permalink / raw)
  To: Roger Pau Monné, Andrew Cooper
  Cc: xen-devel, Konrad Rzeszutek Wilk, Ross Lagerwall

On 17/03/2022 14:16, Roger Pau Monné wrote:
> On Thu, Mar 17, 2022 at 02:00:19PM +0000, Andrew Cooper wrote:
>> On 17/03/2022 11:08, Roger Pau Monne wrote:
>>> A side effect of ignoring such sections is that symbols belonging to
>>> them won't be resolved, and that could make relocations belonging to
>>> other sections that reference those symbols fail.
>>>
>>> For example it's likely to have an empty .altinstr_replacement with
>>> symbols pointing to it, and marking the section as ignored will
>>> prevent the symbols from being resolved, which in turn will cause any
>>> relocations against them to fail.
>> I agree this is a bug in livepatch handling, but it's also an error in
>> the generated livepatch.  We should not have relocations to an empty
>> altinstr_replacement section in the first place.
> Well, the relocation destination is in the .altinstructions section
> (which is not empty). It happens however to reference a symbol that
> points to the .altinstr_replacement section that's empty.
>
> We could likely avoid generating the altinstr_replacement section in
> the first place, but I think it's more robust to handle those properly
> in the elf loading code.

Actually, it turns out it's distinctly non-trivial to omit these
references.  We need to put the replacement somewhere, so we can
subtract the start from the end, and figure out if it is 0.

~Andrew


^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH 1/2] livepatch: do not ignore sections with 0 size
  2022-03-17 11:08 ` [PATCH 1/2] livepatch: do not ignore sections with 0 size Roger Pau Monne
  2022-03-17 14:00   ` Andrew Cooper
@ 2022-03-25 14:05   ` Roger Pau Monné
  2022-04-07 16:16   ` Ross Lagerwall
  2 siblings, 0 replies; 14+ messages in thread
From: Roger Pau Monné @ 2022-03-25 14:05 UTC (permalink / raw)
  To: Roger Pau Monne; +Cc: xen-devel, Konrad Rzeszutek Wilk, Ross Lagerwall

Ping?

There was some discussion on whether we need to handle such empty
sections, but I think we settled that it's necessary.

Thanks, Roger.

On Thu, Mar 17, 2022 at 12:08:53PM +0100, Roger Pau Monne wrote:
> A side effect of ignoring such sections is that symbols belonging to
> them won't be resolved, and that could make relocations belonging to
> other sections that reference those symbols fail.
> 
> For example it's likely to have an empty .altinstr_replacement with
> symbols pointing to it, and marking the section as ignored will
> prevent the symbols from being resolved, which in turn will cause any
> relocations against them to fail.
> 
> In order to solve this do not ignore sections with 0 size, only ignore
> sections that don't have the SHF_ALLOC flag set.
> 
> Special case such empty sections in move_payload so they are not taken
> into account in order to decide whether a livepatch can be safely
> re-applied after a revert.
> 
> Fixes: 98b728a7b2 ('livepatch: Disallow applying after an revert')
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
> ---
>  xen/common/livepatch.c          | 16 +++++++++++-----
>  xen/include/xen/livepatch_elf.h |  2 +-
>  2 files changed, 12 insertions(+), 6 deletions(-)
> 
> diff --git a/xen/common/livepatch.c b/xen/common/livepatch.c
> index be2cf75c2d..abc1cae136 100644
> --- a/xen/common/livepatch.c
> +++ b/xen/common/livepatch.c
> @@ -300,9 +300,6 @@ static int move_payload(struct payload *payload, struct livepatch_elf *elf)
>           * and .shstrtab. For the non-relocate we allocate and copy these
>           * via other means - and the .rel we can ignore as we only use it
>           * once during loading.
> -         *
> -         * Also ignore sections with zero size. Those can be for example:
> -         * data, or .bss.
>           */
>          if ( livepatch_elf_ignore_section(elf->sec[i].sec) )
>              offset[i] = UINT_MAX;
> @@ -361,8 +358,17 @@ static int move_payload(struct payload *payload, struct livepatch_elf *elf)
>              else if ( elf->sec[i].sec->sh_flags & SHF_WRITE )
>              {
>                  buf = rw_buf;
> -                rw_buf_sec = i;
> -                rw_buf_cnt++;
> +                if ( elf->sec[i].sec->sh_size )
> +                {
> +                    /*
> +                     * Special handling of RW empty regions: do not account for
> +                     * them in order to decide whether a patch can safely be
> +                     * re-applied, but assign them a load address so symbol
> +                     * resolution and relocations work.
> +                     */
> +                    rw_buf_sec = i;
> +                    rw_buf_cnt++;
> +                }
>              }
>              else
>                  buf = ro_buf;
> diff --git a/xen/include/xen/livepatch_elf.h b/xen/include/xen/livepatch_elf.h
> index 9ad499ee8b..5b1ec469da 100644
> --- a/xen/include/xen/livepatch_elf.h
> +++ b/xen/include/xen/livepatch_elf.h
> @@ -48,7 +48,7 @@ int livepatch_elf_perform_relocs(struct livepatch_elf *elf);
>  
>  static inline bool livepatch_elf_ignore_section(const Elf_Shdr *sec)
>  {
> -    return !(sec->sh_flags & SHF_ALLOC) || sec->sh_size == 0;
> +    return !(sec->sh_flags & SHF_ALLOC);
>  }
>  #endif /* __XEN_LIVEPATCH_ELF_H__ */
>  
> -- 
> 2.34.1
> 


^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH 1/2] livepatch: do not ignore sections with 0 size
  2022-03-17 11:08 ` [PATCH 1/2] livepatch: do not ignore sections with 0 size Roger Pau Monne
  2022-03-17 14:00   ` Andrew Cooper
  2022-03-25 14:05   ` Roger Pau Monné
@ 2022-04-07 16:16   ` Ross Lagerwall
  2 siblings, 0 replies; 14+ messages in thread
From: Ross Lagerwall @ 2022-04-07 16:16 UTC (permalink / raw)
  To: Roger Pau Monne, xen-devel; +Cc: Konrad Rzeszutek Wilk

> From: Roger Pau Monne <roger.pau@citrix.com>
> Sent: Thursday, March 17, 2022 11:08 AM
> To: xen-devel@lists.xenproject.org <xen-devel@lists.xenproject.org>
> Cc: Roger Pau Monne <roger.pau@citrix.com>; Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>; Ross Lagerwall <ross.lagerwall@citrix.com>
> Subject: [PATCH 1/2] livepatch: do not ignore sections with 0 size 
>  
> A side effect of ignoring such sections is that symbols belonging to
> them won't be resolved, and that could make relocations belonging to
> other sections that reference those symbols fail.
> 
> For example it's likely to have an empty .altinstr_replacement with
> symbols pointing to it, and marking the section as ignored will
> prevent the symbols from being resolved, which in turn will cause any
> relocations against them to fail.
> 
> In order to solve this do not ignore sections with 0 size, only ignore
> sections that don't have the SHF_ALLOC flag set.
> 
> Special case such empty sections in move_payload so they are not taken
> into account in order to decide whether a livepatch can be safely
> re-applied after a revert.
> 
> Fixes: 98b728a7b2 ('livepatch: Disallow applying after an revert')
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>

Reviewed-by: Ross Lagerwall <ross.lagerwall@citrix.com>

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH 2/2] livepatch: avoid relocations referencing ignored section symbols
  2022-03-17 11:08 ` [PATCH 2/2] livepatch: avoid relocations referencing ignored section symbols Roger Pau Monne
  2022-03-17 13:26   ` Jan Beulich
@ 2022-04-07 16:22   ` Ross Lagerwall
  1 sibling, 0 replies; 14+ messages in thread
From: Ross Lagerwall @ 2022-04-07 16:22 UTC (permalink / raw)
  To: Roger Pau Monne, xen-devel
  Cc: Konrad Rzeszutek Wilk, Stefano Stabellini, Julien Grall,
	Bertrand Marquis, Volodymyr Babchuk, Jan Beulich, Andrew Cooper,
	Wei Liu

> From: Roger Pau Monne <roger.pau@citrix.com>
> Sent: Thursday, March 17, 2022 11:08 AM
> To: xen-devel@lists.xenproject.org <xen-devel@lists.xenproject.org>
> Cc: Roger Pau Monne <roger.pau@citrix.com>; Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>; Ross Lagerwall <ross.lagerwall@citrix.com>; Stefano Stabellini <sstabellini@kernel.org>; Julien Grall <julien@xen.org>; Bertrand Marquis <bertrand.marquis@arm.com>; Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>; Jan Beulich <jbeulich@suse.com>; Andrew Cooper <Andrew.Cooper3@citrix.com>; Wei Liu <wl@xen.org>
> Subject: [PATCH 2/2] livepatch: avoid relocations referencing ignored section symbols 
>  
> Track whether symbols belong to ignored sections in order to avoid
> applying relocations referencing those symbols. The address of such
> symbols won't be resolved and thus the relocation will likely fail or
> write garbage to the destination.
> 
> Return an error in that case, as leaving unresolved relocations would
> lead to malfunctioning payload code.
> 
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>

Reviewed-by: Ross Lagerwall <ross.lagerwall@citrix.com>

^ permalink raw reply	[flat|nested] 14+ messages in thread

* Re: [PATCH 0/2] livepatch: fix handling of (some) relocations
@ 2022-03-17 13:00 Doebel, Bjoern
  0 siblings, 0 replies; 14+ messages in thread
From: Doebel, Bjoern @ 2022-03-17 13:00 UTC (permalink / raw)
  To: Roger Pau Monne, xen-devel
  Cc: Konrad Rzeszutek Wilk, Ross Lagerwall, Stefano Stabellini,
	Julien Grall, Bertrand Marquis, Volodymyr Babchuk, Jan Beulich,
	Andrew Cooper, Wei Liu



On 17.03.22, 12:10, "Xen-devel on behalf of Roger Pau Monne" <xen-devel-bounces@lists.xenproject.org on behalf of roger.pau@citrix.com> wrote:


    Hello,

    Relocations that reference symbols that belong to sections with a size
    of 0 are not properly resolved, as the address of those symbols won't be
    resolved in the first place.

    Fix this by not ignoring sections with a size of 0, while still properly
    handling the detection of whether a livepatch can be reapplied after
    being reverted (patch 1).

    Also detect whether any relocations reference unresolved symbols and
    error out in that case, as those relocations cannot be resolved (patch
    2).

    I wonder whether it's possible to have unresolved symbols if we only
    ignore non SHF_ALLOC sections, so we could maybe error out earlier if we
    found a symbols that belongs to a non SHF_ALLOC section in
    livepatch_elf_resolve_symbols.  The current approach is more conservative
    as we would only report an error if we have unresolved symbols that are
    referenced in relocations.

    Thanks, Roger.

    Roger Pau Monne (2):
      livepatch: do not ignore sections with 0 size
      livepatch: avoid relocations referencing ignored section symbols

     xen/arch/arm/arm32/livepatch.c  |  7 +++++++
     xen/arch/arm/arm64/livepatch.c  |  7 +++++++
     xen/arch/x86/livepatch.c        |  7 +++++++
     xen/common/livepatch.c          | 16 +++++++++++-----
     xen/common/livepatch_elf.c      |  6 ++++++
     xen/include/xen/livepatch_elf.h |  3 ++-
     6 files changed, 40 insertions(+), 6 deletions(-)

    --
    2.34.1

I checked the x86 part and confirmed that my previously non-working livepatch loads now.

Tested-by: Bjoern Doebel <doebel@amazon.de>




Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879



^ permalink raw reply	[flat|nested] 14+ messages in thread

end of thread, other threads:[~2022-04-07 16:22 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-17 11:08 [PATCH 0/2] livepatch: fix handling of (some) relocations Roger Pau Monne
2022-03-17 11:08 ` [PATCH 1/2] livepatch: do not ignore sections with 0 size Roger Pau Monne
2022-03-17 14:00   ` Andrew Cooper
2022-03-17 14:09     ` Jan Beulich
2022-03-17 14:16     ` Roger Pau Monné
2022-03-17 14:25       ` Andrew Cooper
2022-03-25 14:05   ` Roger Pau Monné
2022-04-07 16:16   ` Ross Lagerwall
2022-03-17 11:08 ` [PATCH 2/2] livepatch: avoid relocations referencing ignored section symbols Roger Pau Monne
2022-03-17 13:26   ` Jan Beulich
2022-03-17 13:50     ` Roger Pau Monné
2022-04-07 16:22   ` Ross Lagerwall
2022-03-17 13:18 ` [PATCH 0/2] livepatch: fix handling of (some) relocations Jan Beulich
2022-03-17 13:00 Doebel, Bjoern

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.