[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: A possible pointer_overflow in xen-4.13
After patching it, this works fine and UBSAN dose not have any error report about it. ------------------ Original ------------------ From: "Andrew Cooper";<andrew.cooper3@xxxxxxxxxx>; Send time: Saturday, Jun 26, 2021 9:50 PM To: "Rroach"<2284696125@xxxxxx>; "xen-devel"<xen-devel@xxxxxxxxxxxxxxxxxxxx>; Subject: Re: A possible pointer_overflow in xen-4.13 On 26/06/2021 14:29, Rroach wrote:
You say Xen 4.13, but APPEND_CALL() doesn't exist there. I added it in 4.14 when I rewrote this mess to be compatible with CET by not using a ROP gadget. Your backtrace says 4.15 unstable which means its an old staging build (not that that is going to have any effect on this specific issue). The fact that it continued executing correctly means the calculation did the right thing, whether or not UBSAN was happy. The displacement will end up negative as the stub we're writing is numerically higher than {load,save}_guest_gprs(), which I guess means that f - stub_va will underflow. I'm very confused as to why UBSAN reports against save_guest_gprs() considering that load_guest_gprs() when through the exact same logic a few instructions earlier. Either way, does this make the problem go away? diff --git a/xen/arch/x86/pv/emul-priv-op.c b/xen/arch/x86/pv/emul-priv-op.c index 11467a1e3a..be41bced76 100644 --- a/xen/arch/x86/pv/emul-priv-op.c +++ b/xen/arch/x86/pv/emul-priv-op.c @@ -98,7 +98,7 @@ static io_emul_stub_t *io_emul_stub_setup(struct priv_op_ctxt *ctxt, u8 opcode, #define APPEND_BUFF(b) ({ memcpy(p, b, sizeof(b)); p += sizeof(b); }) #define APPEND_CALL(f) \ ({ \ - long disp = (long)(f) - (stub_va + p - ctxt->io_emul_stub + 5); \ + long disp = (long)(f) - (long)(stub_va + p - ctxt->io_emul_stub + 5); \ BUG_ON((int32_t)disp != disp); \ *p++ = 0xe8; \ *(int32_t *)p = disp; p += 4; \ ~Andrew
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |