[LTP] [PATCH] syscalls/pkeys01: use a dummy function instead of function_size

[Li Wang]

On Tue, Nov 19, 2024 at 11:48 PM Jan Stancek <jstancek@redhat.com> wrote:

> As Martin found:
>   The function_size() code
>   is broken in a way that I cannot easily fix. The function tries
>   to calculate the size of a function by finding the first RET
>   instruction. However, in 32bit LTP builds, the code gets compiled
>   to this:
>
>   0804b690 <function_size>:
>    804b690:       8b 4c 24 04             mov    0x4(%esp),%ecx
>    804b694:       0f b6 01                movzbl (%ecx),%eax
>    804b697:       83 c0 3e                add    $0x3e,%eax
>    804b69a:       3c 01                   cmp    $0x1,%al
>    804b69c:       76 1a                   jbe    804b6b8
> <function_size+0x28>
>    804b69e:       89 c8                   mov    %ecx,%eax
>    804b6a0:       83 c0 01                add    $0x1,%eax
>    804b6a3:       0f b6 10                movzbl (%eax),%edx
>    804b6a6:       83 c2 3e                add    $0x3e,%edx
>    804b6a9:       80 fa 01                cmp    $0x1,%dl
>    804b6ac:       77 f2                   ja     804b6a0
> <function_size+0x10>
>    804b6ae:       29 c8                   sub    %ecx,%eax
>    804b6b0:       83 c0 10                add    $0x10,%eax
>    804b6b3:       c3                      ret
>    804b6b4:       8d 74 26 00             lea    0x0(%esi,%eiz,1),%esi
>    804b6b8:       b8 10 00 00 00          mov    $0x10,%eax
>    804b6bd:       c3                      ret
>    804b6be:       66 90                   xchg   %ax,%ax
>
>   If you look closely enough, you'll notice a C2 byte in add $0x3e,%edx
>   instruction on address 804b6a6. The function will assume this byte is
>   a RET instruction, return a size that's 22 bytes too short and then
>   the code execution inside the executable buffer will run past the end
>   of buffer, resulting in a segfault.
>
> Use a dummy function and copy entire page, similar to what we do
> in mprotect04.
>
> Signed-off-by: Jan Stancek <jstancek@redhat.com>
>


This way is better than reverting, thanks!

Reviewed-by: Li Wang <liwang@redhat.com>


-- 
Regards,
Li Wang