xen-devel.lists.xenproject.org archive mirror
 help / color / mirror / Atom feed
From: Bjoern Doebel <doebel@amazon.de>
To: <xen-devel@lists.xenproject.org>
Cc: Michael Kurth <mku@amazon.de>,
	Martin Pohlack <mpohlack@amazon.de>,
	Roger Pau Monne <roger.pau@citrix.com>,
	Bjoern Doebel <doebel@amazon.de>,
	Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
	Ross Lagerwall <ross.lagerwall@citrix.com>
Subject: [RFC PATCH v1] arch/x86: Livepatch: fix overflow check when computing ELF relocations
Date: Tue, 8 Mar 2022 15:36:34 +0000	[thread overview]
Message-ID: <b74a68b038c31df4bb94a5b5e87453f5a249cfe2.1646753657.git.doebel@amazon.de> (raw)

Comparing a signed 64bit integer to a signed 32 bit integer may lead to
unexpected overflows. Adjust the cast to use the same type.

Signed-off-by: Bjoern Doebel <doebel@amazon.de>
CC: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
CC: Ross Lagerwall <ross.lagerwall@citrix.com>
---
I need some input here. When testing the CET-BIT livepatch updates I
noticed that my generated livepatch would not load due to

(XEN) livepatch: vmx: Overflow in relocation 1 in .rela.altinstructions for .altinstructions

A deeper look revealed that the ELF relocation adjustment seems to be
going wrong and that in fact the lower 32bit of the compared values in
my case were identical, but that the cast to int64_t for the value
pulled in extra 32 bits, which turned out to be different.

Applying this patch fixed the issue for my example and I got a fully
working livepatch. However, I do not understand what is actually going
on here, so I'm sending this RFC to get extra eyes on the code.
---
 xen/arch/x86/livepatch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/x86/livepatch.c b/xen/arch/x86/livepatch.c
index 59620b8a4f..5380e18bd9 100644
--- a/xen/arch/x86/livepatch.c
+++ b/xen/arch/x86/livepatch.c
@@ -339,7 +339,7 @@ int arch_livepatch_perform_rela(struct livepatch_elf *elf,
 
             val -= (uint64_t)dest;
             *(int32_t *)dest = val;
-            if ( (int64_t)val != *(int32_t *)dest )
+            if ( (int32_t)val != *(int32_t *)dest )
             {
                 printk(XENLOG_ERR LIVEPATCH "%s: Overflow in relocation %u in %s for %s\n",
                        elf->name, i, rela->name, base->name);
-- 
2.32.0




Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879





             reply	other threads:[~2022-03-08 15:37 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-03-08 15:36 Bjoern Doebel [this message]
2022-03-08 15:45 ` [RFC PATCH v1] arch/x86: Livepatch: fix overflow check when computing ELF relocations Jan Beulich
2022-03-08 16:15   ` Roger Pau Monné
2022-03-08 16:26     ` Roger Pau Monné
2022-03-08 16:53       ` Jan Beulich
2022-03-08 16:54       ` Ross Lagerwall

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=b74a68b038c31df4bb94a5b5e87453f5a249cfe2.1646753657.git.doebel@amazon.de \
    --to=doebel@amazon.de \
    --cc=konrad.wilk@oracle.com \
    --cc=mku@amazon.de \
    --cc=mpohlack@amazon.de \
    --cc=roger.pau@citrix.com \
    --cc=ross.lagerwall@citrix.com \
    --cc=xen-devel@lists.xenproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).