From patchwork Wed Jun 21 18:13:36 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 9802507 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 91E746038C for ; Wed, 21 Jun 2017 18:16:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 808D328623 for ; Wed, 21 Jun 2017 18:16:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 748CB2863A; Wed, 21 Jun 2017 18:16:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 6444428623 for ; Wed, 21 Jun 2017 18:16:32 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dNk8V-0004tn-Kx; Wed, 21 Jun 2017 18:13:51 +0000 Received: from mail6.bemta6.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dNk8V-0004th-8s for xen-devel@lists.xen.org; Wed, 21 Jun 2017 18:13:51 +0000 Received: from [85.158.143.35] by server-8.bemta-6.messagelabs.com id B8/19-03696-E57BA495; Wed, 21 Jun 2017 18:13:50 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmphkeJIrShJLcpLzFFi42JxWrrBXjduu1e kwfS7LBZLPi5mcWD0OLr7N1MAYxRrZl5SfkUCa8acLZPYC3qUK3ZvCmpgbJDsYuTgkBDwl1g3 j7WLkZODTUBfYveLT0wgtoiAusTpjotAcS4OZoH/jBI73n1gA0kIC8RI/Fpwlh3EZhFQlfjz+ hkziM0r4Cnx8NMmsGYJATmJ88d/gsU5BbwkDny+DmYLAdVs7jrKBmGrSVzrv8QO0SsocXLmEx YQm1lAQuLgixfMExh5ZyFJzUKSWsDItIpRozi1qCy1SNfQQC+pKDM9oyQ3MTMHyDPTy00tLk5 MT81JTCrWS87P3cQIDB0GINjBeG9ZwCFGSQ4mJVHejmVekUJ8SfkplRmJxRnxRaU5qcWHGGU4 OJQkeE9sBcoJFqWmp1akZeYAgxgmLcHBoyTCq7MGKM1bXJCYW5yZDpE6xagoJc6rsQ0oIQCSy CjNg2uDRc4lRlkpYV5GoEOEeApSi3IzS1DlXzGKczAqCfOKgkzhycwrgZv+CmgxE9DiF0c8QB aXJCKkpBoYcyZWva9PYZh+L2Wj6c6L9Y5TTknfNe2RUFNvaxPstvu2Xq6kq+i9RtmaU+WbBRp ueD8ODild9CPd48KFjJhZTtryWz8pFcl+rr3rxSBxJJnzdtySUxH/nTtcTR5M2tH/er89U03H yTV8v9JMzzZ+u7+6zJhlU0/EaZ1j7U0afA9FM4Ik1q5VYinOSDTUYi4qTgQAzAJlC5cCAAA= X-Env-Sender: prvs=338940b9e=Andrew.Cooper3@citrix.com X-Msg-Ref: server-3.tower-21.messagelabs.com!1498068828!71534483!1 X-Originating-IP: [66.165.176.63] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni42MyA9PiAzMDYwNDg=\n, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 9.4.19; banners=-,-,- X-VirusChecked: Checked Received: (qmail 40880 invoked from network); 21 Jun 2017 18:13:49 -0000 Received: from smtp02.citrix.com (HELO SMTP02.CITRIX.COM) (66.165.176.63) by server-3.tower-21.messagelabs.com with RC4-SHA encrypted SMTP; 21 Jun 2017 18:13:49 -0000 X-IronPort-AV: E=Sophos;i="5.39,370,1493683200"; d="scan'208";a="437362431" From: Andrew Cooper To: Xen-devel Date: Wed, 21 Jun 2017 19:13:36 +0100 Message-ID: <1498068816-21894-1-git-send-email-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1497387096-19058-2-git-send-email-andrew.cooper3@citrix.com> References: <1497387096-19058-2-git-send-email-andrew.cooper3@citrix.com> MIME-Version: 1.0 Cc: Stefano Stabellini , Andrew Cooper , Ross Lagerwall , Julien Grall , Jan Beulich Subject: [Xen-devel] [PATCH for-4.9 v2] xen/livepatch: Don't crash on encountering STN_UNDEF relocations X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP A symndx of STN_UNDEF is special, and means a symbol value of 0. While legitimate in the ELF standard, its existance in a livepatch is questionable at best. Until a plausible usecase presents itself, reject such a relocation with -EOPNOTSUPP. Additionally, perform a safety check on elf->sym[symndx].sym before derefencing it, to avoid tripping over a NULL pointer when calculating val. Signed-off-by: Andrew Cooper Reviewed-by: Konrad Rzeszutek Wilk Tested-by: Konrad Rzeszutek Wilk [x86 right now, will do Reviewed-by: Ross Lagerwall Tested-by: Konrad Rzeszutek Wilk [x86, arm32] --- CC: Konrad Rzeszutek Wilk CC: Ross Lagerwall CC: Jan Beulich CC: Stefano Stabellini CC: Julien Grall v2: * Reject STN_UNDEF with -EOPNOTSUPP --- xen/arch/arm/arm32/livepatch.c | 17 +++++++++++++++-- xen/arch/arm/arm64/livepatch.c | 17 +++++++++++++++-- xen/arch/x86/livepatch.c | 17 +++++++++++++++-- 3 files changed, 45 insertions(+), 6 deletions(-) diff --git a/xen/arch/arm/arm32/livepatch.c b/xen/arch/arm/arm32/livepatch.c index a328179..53fee91 100644 --- a/xen/arch/arm/arm32/livepatch.c +++ b/xen/arch/arm/arm32/livepatch.c @@ -254,14 +254,27 @@ int arch_livepatch_perform(struct livepatch_elf *elf, addend = get_addend(type, dest); } + if ( symndx == STN_UNDEF ) + { + dprintk(XENLOG_ERR, LIVEPATCH "%s: Encountered STN_UNDEF\n", + elf->name); + return -EOPNOTSUPP; + } + if ( symndx > elf->nsym ) { dprintk(XENLOG_ERR, LIVEPATCH "%s: Relative symbol wants symbol@%u which is past end!\n", elf->name, symndx); return -EINVAL; } - - val = elf->sym[symndx].sym->st_value; /* S */ + else if ( !elf->sym[symndx].sym ) + { + dprintk(XENLOG_ERR, LIVEPATCH "%s: No relative symbol@%u\n", + elf->name, symndx); + return -EINVAL; + } + else + val = elf->sym[symndx].sym->st_value; /* S */ rc = perform_rel(type, dest, val, addend); switch ( rc ) diff --git a/xen/arch/arm/arm64/livepatch.c b/xen/arch/arm/arm64/livepatch.c index 63929b1..b033763 100644 --- a/xen/arch/arm/arm64/livepatch.c +++ b/xen/arch/arm/arm64/livepatch.c @@ -252,14 +252,27 @@ int arch_livepatch_perform_rela(struct livepatch_elf *elf, int ovf = 0; uint64_t val; + if ( symndx == STN_UNDEF ) + { + dprintk(XENLOG_ERR, LIVEPATCH "%s: Encountered STN_UNDEF\n", + elf->name); + return -EOPNOTSUPP; + } + if ( symndx > elf->nsym ) { dprintk(XENLOG_ERR, LIVEPATCH "%s: Relative relocation wants symbol@%u which is past end!\n", elf->name, symndx); return -EINVAL; } - - val = elf->sym[symndx].sym->st_value + r->r_addend; /* S+A */ + else if ( !elf->sym[symndx].sym ) + { + dprintk(XENLOG_ERR, LIVEPATCH "%s: No relative symbol@%u\n", + elf->name, symndx); + return -EINVAL; + } + else + val = elf->sym[symndx].sym->st_value + r->r_addend; /* S+A */ /* ARM64 operations at minimum are always 32-bit. */ if ( r->r_offset >= base->sec->sh_size || diff --git a/xen/arch/x86/livepatch.c b/xen/arch/x86/livepatch.c index 7917610..bfa576c 100644 --- a/xen/arch/x86/livepatch.c +++ b/xen/arch/x86/livepatch.c @@ -170,14 +170,27 @@ int arch_livepatch_perform_rela(struct livepatch_elf *elf, uint8_t *dest = base->load_addr + r->r_offset; uint64_t val; + if ( symndx == STN_UNDEF ) + { + dprintk(XENLOG_ERR, LIVEPATCH "%s: Encountered STN_UNDEF\n", + elf->name); + return -EOPNOTSUPP; + } + if ( symndx > elf->nsym ) { dprintk(XENLOG_ERR, LIVEPATCH "%s: Relative relocation wants symbol@%u which is past end!\n", elf->name, symndx); return -EINVAL; } - - val = r->r_addend + elf->sym[symndx].sym->st_value; + else if ( !elf->sym[symndx].sym ) + { + dprintk(XENLOG_ERR, LIVEPATCH "%s: No symbol@%u\n", + elf->name, symndx); + return -EINVAL; + } + else + val = r->r_addend + elf->sym[symndx].sym->st_value; switch ( ELF64_R_TYPE(r->r_info) ) {