From 0f9afc265a4a0f4ba658d7f71c9602a3fda3538e Mon Sep 17 00:00:00 2001 From: "H.J. Lu" Date: Sat, 6 Jan 2024 14:03:37 -0800 Subject: x32: Handle displacement overflow in PLT rewrite [BZ #31218] PLT rewrite calculated displacement with ElfW(Addr) disp = value - branch_start - JMP32_INSN_SIZE; On x32, displacement from 0xf7fbe060 to 0x401030 was calculated as unsigned int disp = 0x401030 - 0xf7fbe060 - 5; with disp == 0x8442fcb and caused displacement overflow. The PLT entry was changed to: 0xf7fbe060 <+0>: e9 cb 2f 44 08 jmp 0x401030 0xf7fbe065 <+5>: cc int3 0xf7fbe066 <+6>: cc int3 0xf7fbe067 <+7>: cc int3 0xf7fbe068 <+8>: cc int3 0xf7fbe069 <+9>: cc int3 0xf7fbe06a <+10>: cc int3 0xf7fbe06b <+11>: cc int3 0xf7fbe06c <+12>: cc int3 0xf7fbe06d <+13>: cc int3 0xf7fbe06e <+14>: cc int3 0xf7fbe06f <+15>: cc int3 x32 has 32-bit address range, but it doesn't wrap address around at 4GB, JMP target was changed to 0x100401030 (0xf7fbe060LL + 0x8442fcbLL + 5), which is above 4GB. Always use uint64_t to calculate displacement. This fixes BZ #31218. Reviewed-by: Noah Goldstein --- sysdeps/x86_64/dl-machine.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'sysdeps/x86_64/dl-machine.h') diff --git a/sysdeps/x86_64/dl-machine.h b/sysdeps/x86_64/dl-machine.h index ca290ef082..2d2ce503a5 100644 --- a/sysdeps/x86_64/dl-machine.h +++ b/sysdeps/x86_64/dl-machine.h @@ -607,8 +607,9 @@ x86_64_rewrite_plt (struct link_map *map, ElfW(Addr) plt_rewrite) /* Skip ENDBR64 if IBT isn't enabled. */ if (!ibt_enabled_p) branch_start = ALIGN_DOWN (branch_start, pltent); - /* Get the displacement from the branch target. */ - ElfW(Addr) disp = value - branch_start - JMP32_INSN_SIZE; + /* Get the displacement from the branch target. NB: We must use + 64-bit integer on x32 to avoid overflow. */ + uint64_t disp = (uint64_t) value - branch_start - JMP32_INSN_SIZE; ElfW(Addr) plt_end; ElfW(Addr) pad; -- cgit 1.4.1