Skip to contentSkip to conversation

m32r: test before subtraction on unsigned relocation range

PATCH Superseded Roel Kluin 2 participants 4 messages Apr 23, 2008 – Apr 25, 2008

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 m32r: test before subtraction on unsigned relocation range

relocation is unsigned

Signed-off-by Roel Kluin <[email protected]>

---

arch/m32r/kernel/module.c +8 -6
index 8d42057..abecedf 100644
@@ -171,13 +171,14 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
 	    		COPY_UNALIGNED_WORD (value, *location, align);
 			break;
 		case R_M32R_18_PCREL_RELA:
-	  		relocation = (relocation - (Elf32_Addr) location);
-			if (relocation < -0x20000 || 0x1fffc < relocation)
+			if (relocation + 0x20000 < (Elf32_Addr) location ||
+					relocation >= 0x1fffc + (Elf32_Addr) location)
 				{
 					printk(KERN_ERR "module %s: relocation overflow: %u\n",
-					me->name, relocation);
+					me->name, relocation - (Elf32_Addr) location));
 					return -ENOEXEC;
 				}
+			relocation = (relocation - (Elf32_Addr) location);
 	    		COPY_UNALIGNED_WORD (*location, value, align);
 			if (value & 0xffff)
 				{

@@ -203,13 +204,14 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
 	    		COPY_UNALIGNED_HWORD (hvalue, *hlocation, align);
 			break;
 		case R_M32R_26_PCREL_RELA:
-	  		relocation = (relocation - (Elf32_Addr) location);
-			if (relocation < -0x2000000 || 0x1fffffc < relocation)
+			if (relocation + 0x20000 < (Elf32_Addr) location ||
+					relocation >= 0x1fffc + (Elf32_Addr) location)
 				{
 					printk(KERN_ERR "module %s: relocation overflow: %u\n",
-					me->name, relocation);
+					me->name, relocation - (Elf32_Addr) location));
 					return -ENOEXEC;
 				}
+			relocation = (relocation - (Elf32_Addr) location);
 	    		COPY_UNALIGNED_WORD (*location, value, align);
 			if (value & 0xffffff)
 				{
#1 lore raw

From: Roel Kluin <[email protected]>
Subject: [PATCH] m32r: test before subtraction on unsigned relocation range
Date: Wed, 23 Apr 2008 18:34:16 +0200

arch/m32r/kernel/module.c int apply_relocate_add(Elf32_Shdr *sechdrs, · line 208

Quoted 5 lines
arch/m32r/kernel/module.c +2 -2
 		case R_M32R_26_PCREL_RELA:
-	  		relocation = (relocation - (Elf32_Addr) location);
-			if (relocation < -0x2000000 || 0x1fffffc < relocation)
+			if (relocation + 0x20000 < (Elf32_Addr) location ||
+					relocation >= 0x1fffc + (Elf32_Addr) location)

A slight fix is required.

The above range check is incorrect, because the R_M32R_26_PCREL_RELA is 26-bit relocation.

-- Takata

author
#2 lore raw

PATCH v2 1/1 m32r: test before subtraction on unsigned relocation range

Quoted 11 lines · Hirokazu Takata

From: Roel Kluin <[email protected]>
Subject: [PATCH] m32r: test before subtraction on unsigned relocation range
Date: Wed, 23 Apr 2008 18:34:16 +0200

Review

Quoted 5 lines
(quoted diff) +2 -2
 		case R_M32R_26_PCREL_RELA:
-	  		relocation = (relocation - (Elf32_Addr) location);
-			if (relocation < -0x2000000 || 0x1fffffc < relocation)
+			if (relocation + 0x20000 < (Elf32_Addr) location ||
+					relocation >= 0x1fffc + (Elf32_Addr) location)

A slight fix is required.

Quoted 5 lines

The above range check is incorrect, because the R_M32R_26_PCREL_RELA is 26-bit relocation.

-- Takata

Thanks for spotting this!
---
Relocation is unsigned, test before subtraction

Signed-off-by Roel Kluin <[email protected]>

---

arch/m32r/kernel/module.c +8 -6
index 8d42057..947def6 100644
@@ -171,13 +171,14 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
 	    		COPY_UNALIGNED_WORD (value, *location, align);
 			break;
 		case R_M32R_18_PCREL_RELA:
-	  		relocation = (relocation - (Elf32_Addr) location);
-			if (relocation < -0x20000 || 0x1fffc < relocation)
+			if (relocation + 0x20000 < (Elf32_Addr) location ||
+					relocation >= 0x1fffc + (Elf32_Addr) location)
 				{
 					printk(KERN_ERR "module %s: relocation overflow: %u\n",
-					me->name, relocation);
+					me->name, relocation - (Elf32_Addr) location));
 					return -ENOEXEC;
 				}
+			relocation = (relocation - (Elf32_Addr) location);
 	    		COPY_UNALIGNED_WORD (*location, value, align);
 			if (value & 0xffff)
 				{

@@ -203,13 +204,14 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
 	    		COPY_UNALIGNED_HWORD (hvalue, *hlocation, align);
 			break;
 		case R_M32R_26_PCREL_RELA:
-	  		relocation = (relocation - (Elf32_Addr) location);
-			if (relocation < -0x2000000 || 0x1fffffc < relocation)
+			if (relocation + 0x2000000 < (Elf32_Addr) location ||
+					relocation >= 0x1fffffc + (Elf32_Addr) location)
 				{
 					printk(KERN_ERR "module %s: relocation overflow: %u\n",
-					me->name, relocation);
+					me->name, relocation - (Elf32_Addr) location));
 					return -ENOEXEC;
 				}
+			relocation = (relocation - (Elf32_Addr) location);
 	    		COPY_UNALIGNED_WORD (*location, value, align);
 			if (value & 0xffffff)
 				{
author
#3 lore raw

PATCH v2 1/1 m32r: test before subtraction on unsigned relocation range

In reply to Hirokazu Takata
Quoted 11 lines · Hirokazu Takata

From: Roel Kluin <[email protected]>
Subject: [PATCH] m32r: test before subtraction on unsigned relocation range
Date: Wed, 23 Apr 2008 18:34:16 +0200

Review

Quoted 5 lines
(quoted diff) +2 -2
 		case R_M32R_26_PCREL_RELA:
-	  		relocation = (relocation - (Elf32_Addr) location);
-			if (relocation < -0x2000000 || 0x1fffffc < relocation)
+			if (relocation + 0x20000 < (Elf32_Addr) location ||
+					relocation >= 0x1fffc + (Elf32_Addr) location)

A slight fix is required.

Quoted 5 lines

The above range check is incorrect, because the R_M32R_26_PCREL_RELA is 26-bit relocation.

-- Takata

Thanks for spotting this!
---
Relocation is unsigned, test before subtraction

Signed-off-by Roel Kluin <[email protected]>

---

arch/m32r/kernel/module.c +8 -6
index 8d42057..947def6 100644
@@ -171,13 +171,14 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
 	    		COPY_UNALIGNED_WORD (value, *location, align);
 			break;
 		case R_M32R_18_PCREL_RELA:
-	  		relocation = (relocation - (Elf32_Addr) location);
-			if (relocation < -0x20000 || 0x1fffc < relocation)
+			if (relocation + 0x20000 < (Elf32_Addr) location ||
+					relocation >= 0x1fffc + (Elf32_Addr) location)
 				{
 					printk(KERN_ERR "module %s: relocation overflow: %u\n",
-					me->name, relocation);
+					me->name, relocation - (Elf32_Addr) location));
 					return -ENOEXEC;
 				}
+			relocation = (relocation - (Elf32_Addr) location);
 	    		COPY_UNALIGNED_WORD (*location, value, align);
 			if (value & 0xffff)
 				{

@@ -203,13 +204,14 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
 	    		COPY_UNALIGNED_HWORD (hvalue, *hlocation, align);
 			break;
 		case R_M32R_26_PCREL_RELA:
-	  		relocation = (relocation - (Elf32_Addr) location);
-			if (relocation < -0x2000000 || 0x1fffffc < relocation)
+			if (relocation + 0x2000000 < (Elf32_Addr) location ||
+					relocation >= 0x1fffffc + (Elf32_Addr) location)
 				{
 					printk(KERN_ERR "module %s: relocation overflow: %u\n",
-					me->name, relocation);
+					me->name, relocation - (Elf32_Addr) location));
 					return -ENOEXEC;
 				}
+			relocation = (relocation - (Elf32_Addr) location);
 	    		COPY_UNALIGNED_WORD (*location, value, align);
 			if (value & 0xffffff)
 				{