From: Stefano Stabellini <sstabellini@kernel.org>
To: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: Stefano Stabellini <sstabellini@kernel.org>,
Xen-devel <xen-devel@lists.xen.org>,
Ross Lagerwall <ross.lagerwall@citrix.com>,
Julien Grall <julien.grall@arm.com>,
Jan Beulich <JBeulich@suse.com>
Subject: Re: [PATCH for-4.9 v3 3/3] xen/livepatch: Don't crash on encountering STN_UNDEF relocations
Date: Thu, 22 Jun 2017 14:10:15 -0700 (PDT) [thread overview]
Message-ID: <alpine.DEB.2.10.1706221410000.12819@sstabellini-ThinkPad-X260> (raw)
In-Reply-To: <1498155329-4752-4-git-send-email-andrew.cooper3@citrix.com>
On Thu, 22 Jun 2017, Andrew Cooper wrote:
> A symndx of STN_UNDEF is special, and means a symbol value of 0. While
> legitimate in the ELF standard, its existance in a livepatch is questionable
> at best. Until a plausible usecase presents itself, reject such a relocation
> with -EOPNOTSUPP.
>
> Additionally, fix an off-by-one error while range checking symndx, and perform
> a safety check on elf->sym[symndx].sym before derefencing it, to avoid
> tripping over a NULL pointer when calculating val.
>
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> ---
> CC: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> CC: Ross Lagerwall <ross.lagerwall@citrix.com>
> CC: Jan Beulich <JBeulich@suse.com>
> CC: Stefano Stabellini <sstabellini@kernel.org>
> CC: Julien Grall <julien.grall@arm.com>
>
> v3:
> * Fix off-by-one error
> v2:
> * Reject STN_UNDEF with -EOPNOTSUPP
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
> ---
> xen/arch/arm/arm32/livepatch.c | 14 +++++++++++++-
> xen/arch/arm/arm64/livepatch.c | 14 +++++++++++++-
> xen/arch/x86/livepatch.c | 14 +++++++++++++-
> 3 files changed, 39 insertions(+), 3 deletions(-)
>
> diff --git a/xen/arch/arm/arm32/livepatch.c b/xen/arch/arm/arm32/livepatch.c
> index a328179..41378a5 100644
> --- a/xen/arch/arm/arm32/livepatch.c
> +++ b/xen/arch/arm/arm32/livepatch.c
> @@ -254,12 +254,24 @@ int arch_livepatch_perform(struct livepatch_elf *elf,
> addend = get_addend(type, dest);
> }
>
> - if ( symndx > elf->nsym )
> + if ( symndx == STN_UNDEF )
> + {
> + dprintk(XENLOG_ERR, LIVEPATCH "%s: Encountered STN_UNDEF\n",
> + elf->name);
> + return -EOPNOTSUPP;
> + }
> + else if ( symndx >= elf->nsym )
> {
> dprintk(XENLOG_ERR, LIVEPATCH "%s: Relative symbol wants symbol@%u which is past end!\n",
> elf->name, symndx);
> return -EINVAL;
> }
> + else if ( !elf->sym[symndx].sym )
> + {
> + dprintk(XENLOG_ERR, LIVEPATCH "%s: No relative symbol@%u\n",
> + elf->name, symndx);
> + return -EINVAL;
> + }
>
> val = elf->sym[symndx].sym->st_value; /* S */
>
> diff --git a/xen/arch/arm/arm64/livepatch.c b/xen/arch/arm/arm64/livepatch.c
> index 63929b1..2247b92 100644
> --- a/xen/arch/arm/arm64/livepatch.c
> +++ b/xen/arch/arm/arm64/livepatch.c
> @@ -252,12 +252,24 @@ int arch_livepatch_perform_rela(struct livepatch_elf *elf,
> int ovf = 0;
> uint64_t val;
>
> - if ( symndx > elf->nsym )
> + if ( symndx == STN_UNDEF )
> + {
> + dprintk(XENLOG_ERR, LIVEPATCH "%s: Encountered STN_UNDEF\n",
> + elf->name);
> + return -EOPNOTSUPP;
> + }
> + else if ( symndx >= elf->nsym )
> {
> dprintk(XENLOG_ERR, LIVEPATCH "%s: Relative relocation wants symbol@%u which is past end!\n",
> elf->name, symndx);
> return -EINVAL;
> }
> + else if ( !elf->sym[symndx].sym )
> + {
> + dprintk(XENLOG_ERR, LIVEPATCH "%s: No relative symbol@%u\n",
> + elf->name, symndx);
> + return -EINVAL;
> + }
>
> val = elf->sym[symndx].sym->st_value + r->r_addend; /* S+A */
>
> diff --git a/xen/arch/x86/livepatch.c b/xen/arch/x86/livepatch.c
> index 7917610..406eb91 100644
> --- a/xen/arch/x86/livepatch.c
> +++ b/xen/arch/x86/livepatch.c
> @@ -170,12 +170,24 @@ int arch_livepatch_perform_rela(struct livepatch_elf *elf,
> uint8_t *dest = base->load_addr + r->r_offset;
> uint64_t val;
>
> - if ( symndx > elf->nsym )
> + if ( symndx == STN_UNDEF )
> + {
> + dprintk(XENLOG_ERR, LIVEPATCH "%s: Encountered STN_UNDEF\n",
> + elf->name);
> + return -EOPNOTSUPP;
> + }
> + else if ( symndx >= elf->nsym )
> {
> dprintk(XENLOG_ERR, LIVEPATCH "%s: Relative relocation wants symbol@%u which is past end!\n",
> elf->name, symndx);
> return -EINVAL;
> }
> + else if ( !elf->sym[symndx].sym )
> + {
> + dprintk(XENLOG_ERR, LIVEPATCH "%s: No symbol@%u\n",
> + elf->name, symndx);
> + return -EINVAL;
> + }
>
> val = r->r_addend + elf->sym[symndx].sym->st_value;
>
> --
> 2.1.4
>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
next prev parent reply other threads:[~2017-06-22 21:10 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-22 18:15 [PATCH for-4.9 v3 0/3] Fixes for livepatching Andrew Cooper
2017-06-22 18:15 ` [PATCH for-4.9 v3 1/3] xen/livepatch: Clean up arch relocation handling Andrew Cooper
2017-06-22 18:15 ` [PATCH for-4.9 v3 2/3] xen/livepatch: Use zeroed memory allocations for arrays Andrew Cooper
2017-06-23 2:55 ` Konrad Rzeszutek Wilk
2017-06-23 12:31 ` Ross Lagerwall
2017-06-22 18:15 ` [PATCH for-4.9 v3 3/3] xen/livepatch: Don't crash on encountering STN_UNDEF relocations Andrew Cooper
2017-06-22 21:10 ` Stefano Stabellini [this message]
2017-06-23 2:56 ` Konrad Rzeszutek Wilk
2017-06-23 9:50 ` Jan Beulich
2017-06-23 10:13 ` Andrew Cooper
2017-06-23 12:35 ` Ross Lagerwall
2017-06-23 13:32 ` Julien Grall
2017-06-23 13:33 ` Andrew Cooper
2017-06-23 13:43 ` Julien Grall
2017-06-23 13:45 ` Andrew Cooper
2017-06-23 13:47 ` Julien Grall
2017-06-23 14:35 ` Konrad Rzeszutek Wilk
2017-06-23 14:36 ` Julien Grall
2017-06-23 14:46 ` Konrad Rzeszutek Wilk
2017-06-24 17:28 ` Julien Grall
2017-06-26 1:02 ` Konrad Rzeszutek Wilk
2017-06-26 9:34 ` Julien Grall
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.10.1706221410000.12819@sstabellini-ThinkPad-X260 \
--to=sstabellini@kernel.org \
--cc=JBeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=julien.grall@arm.com \
--cc=ross.lagerwall@citrix.com \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.