diff options
| author | H.J. Lu <hjl.tools@gmail.com> | 2024-01-06 14:03:37 -0800 |
|---|---|---|
| committer | H.J. Lu <hjl.tools@gmail.com> | 2024-01-06 14:25:49 -0800 |
| commit | 0f9afc265a4a0f4ba658d7f71c9602a3fda3538e (patch) | |
| tree | 1415b8a9d056e30603381edf9728ebb4a3b9f063 /sysdeps/x86_64/Makefile | |
| parent | b96a2eba2fcca37deea221a18c998ee0084a5d21 (diff) | |
| download | glibc-0f9afc265a4a0f4ba658d7f71c9602a3fda3538e.tar.gz glibc-0f9afc265a4a0f4ba658d7f71c9602a3fda3538e.tar.xz glibc-0f9afc265a4a0f4ba658d7f71c9602a3fda3538e.zip | |
x32: Handle displacement overflow in PLT rewrite [BZ #31218]
PLT rewrite calculated displacement with ElfW(Addr) disp = value - branch_start - JMP32_INSN_SIZE; On x32, displacement from 0xf7fbe060 to 0x401030 was calculated as unsigned int disp = 0x401030 - 0xf7fbe060 - 5; with disp == 0x8442fcb and caused displacement overflow. The PLT entry was changed to: 0xf7fbe060 <+0>: e9 cb 2f 44 08 jmp 0x401030 0xf7fbe065 <+5>: cc int3 0xf7fbe066 <+6>: cc int3 0xf7fbe067 <+7>: cc int3 0xf7fbe068 <+8>: cc int3 0xf7fbe069 <+9>: cc int3 0xf7fbe06a <+10>: cc int3 0xf7fbe06b <+11>: cc int3 0xf7fbe06c <+12>: cc int3 0xf7fbe06d <+13>: cc int3 0xf7fbe06e <+14>: cc int3 0xf7fbe06f <+15>: cc int3 x32 has 32-bit address range, but it doesn't wrap address around at 4GB, JMP target was changed to 0x100401030 (0xf7fbe060LL + 0x8442fcbLL + 5), which is above 4GB. Always use uint64_t to calculate displacement. This fixes BZ #31218. Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
Diffstat (limited to 'sysdeps/x86_64/Makefile')
| -rw-r--r-- | sysdeps/x86_64/Makefile | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile index 374bca80d0..836e03a224 100644 --- a/sysdeps/x86_64/Makefile +++ b/sysdeps/x86_64/Makefile @@ -186,9 +186,11 @@ endif ifeq (yes,$(have-z-mark-plt)) tests += \ tst-plt-rewrite1 \ + tst-plt-rewrite2 \ # tests modules-names += \ tst-plt-rewritemod1 \ + tst-plt-rewritemod2 \ # modules-names tst-plt-rewrite1-no-pie = yes @@ -200,6 +202,12 @@ $(objpfx)tst-plt-rewrite1.out: /dev/null $(objpfx)tst-plt-rewrite1 $(tst-plt-rewrite1-ENV) $(make-test-out) > $@ 2>&1; \ grep -q -E "changing 'bar' PLT entry in .*/elf/tst-plt-rewritemod1.so' to direct branch" $@; \ $(evaluate-test) + +tst-plt-rewrite2-no-pie = yes +LDFLAGS-tst-plt-rewrite2 = -Wl,-z,now +LDFLAGS-tst-plt-rewritemod2.so = -Wl,-z,now,-z,undefs +tst-plt-rewrite2-ENV = GLIBC_TUNABLES=glibc.cpu.plt_rewrite=2 +$(objpfx)tst-plt-rewrite2: $(objpfx)tst-plt-rewritemod2.so endif endif # $(subdir) == elf |