[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [PATCH v3 3/5] xen/livepatch: do Xen build-id check earlier
On Thu, Sep 26, 2024 at 05:11:19PM +0100, Ross Lagerwall wrote: > On Thu, Sep 26, 2024 at 11:21 AM Roger Pau Monne <roger.pau@xxxxxxxxxx> wrote: > > > > The check against the expected Xen build ID should be done ahead of > > attempting > > to apply the alternatives contained in the livepatch. > > > > If the CPUID in the alternatives patching data is out of the scope of the > > running Xen featureset the BUG() in _apply_alternatives() will trigger thus > > bringing the system down. Note the layout of struct alt_instr could also > > change between versions. It's also possible for struct > > exception_table_entry > > to have changed format, hence leading to other kind of errors if parsing of > > the > > payload is done ahead of checking if the Xen build-id matches. > > > > Move the Xen build ID check as early as possible. To do so introduce a new > > check_xen_buildid() function that parses and checks the Xen build-id before > > moving the payload. Since the expected Xen build-id is used early to > > detect whether the livepatch payload could be loaded, there's no reason to > > store it in the payload struct, as a non-matching Xen build-id won't get the > > payload populated in the first place. > > > > Note printing the expected Xen build ID has part of dumping the payload > > information is no longer done: all loaded payloads would have Xen build IDs > > matching the running Xen, otherwise they would have failed to load. > > > > Fixes: 879615f5db1d ('livepatch: Always check hypervisor build ID upon > > livepatch upload') > > Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx> > > Reviewed-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx> > > Should the ELF_LIVEPATCH_XEN_DEPENDS check also be dropped from > check_special_sections() since it is no longer necessary? It's dropped from check_special_sections() in this patch, just not mentioned in the commit message I'm afraid. Thanks, Roger.
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |