While not triggered by the trivial xen_nop in-tree patch on
staging/master, that patch exposes a problem on the stable trees, where
all functions have ENDBR inserted. When NOP-ing out a range, we need to
account for this. Handle this right in livepatch_insn_len().
This requires livepatch_insn_len() to be called _after_ ->patch_offset
was set.
Fixes: 6974c75180f1 ("xen/x86: Livepatch: support patching CET-enhanced functions")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
v3: Drop 1st livepatch_insn_len(). Drop buffer overrun fix.
v2: Re-issue livepatch_insn_len(). Fix buffer overrun.
---
Only build tested, as I don't have a live patching environment available.
For Arm this assumes that the patch_offset field starts out as zero; I
think we can make such an assumption, yet otoh on x86 explicit
initialization was added by the cited commit.
I think there's more fallout from the cited commit, but that'll need to
wait.
--- a/xen/arch/x86/livepatch.c
+++ b/xen/arch/x86/livepatch.c
@@ -145,9 +145,6 @@ void noinline arch_livepatch_apply(struc
func->patch_offset = 0;
old_ptr = func->old_addr;
- len = livepatch_insn_len(func);
- if ( !len )
- return;
/*
* CET hotpatching support: We may have functions starting with an ENDBR64
@@ -160,6 +157,11 @@ void noinline arch_livepatch_apply(struc
if ( is_endbr64(old_ptr) || is_endbr64_poison(func->old_addr) )
func->patch_offset += ENDBR64_LEN;
+ /* This call must be done with ->patch_offset already set. */
+ len = livepatch_insn_len(func);
+ if ( !len )
+ return;
+
memcpy(func->opaque, old_ptr + func->patch_offset, len);
if ( func->new_addr )
{
--- a/xen/include/xen/livepatch.h
+++ b/xen/include/xen/livepatch.h
@@ -90,7 +90,7 @@ static inline
unsigned int livepatch_insn_len(const struct livepatch_func *func)
{
if ( !func->new_addr )
- return func->new_size;
+ return func->new_size - func->patch_offset;
return ARCH_PATCH_INSN_SIZE;
}