Re: [LTP] [PATCH] Revert "pkey01: Adding test for PKEY_DISABLE_EXECUTE"

[Petr Vorel <pvorel@suse.cz>]

Hi Li, Martin,

> Sorry, I forgot to CC Li in the patch.

> On 15. 11. 24 16:44, Martin Doucha wrote:
> > This reverts commit d2b8a476c29d52c484b387454082bbc906b0b4f8.

> > Remove the PKEY_DISABLE_EXECUTE subtest. The function_size() code
> > is broken in a way that I cannot easily fix. The function tries
> > to calculate the size of a function by finding the first RET
> > instruction. However, in 32bit LTP builds, the code gets compiled
> > to this:

> > 0804b690 <function_size>:
> >   804b690:       8b 4c 24 04             mov    0x4(%esp),%ecx
> >   804b694:       0f b6 01                movzbl (%ecx),%eax
> >   804b697:       83 c0 3e                add    $0x3e,%eax
> >   804b69a:       3c 01                   cmp    $0x1,%al
> >   804b69c:       76 1a                   jbe    804b6b8 <function_size+0x28>
> >   804b69e:       89 c8                   mov    %ecx,%eax
> >   804b6a0:       83 c0 01                add    $0x1,%eax
> >   804b6a3:       0f b6 10                movzbl (%eax),%edx
> >   804b6a6:       83 c2 3e                add    $0x3e,%edx
> >   804b6a9:       80 fa 01                cmp    $0x1,%dl
> >   804b6ac:       77 f2                   ja     804b6a0 <function_size+0x10>
> >   804b6ae:       29 c8                   sub    %ecx,%eax
> >   804b6b0:       83 c0 10                add    $0x10,%eax
> >   804b6b3:       c3                      ret
> >   804b6b4:       8d 74 26 00             lea    0x0(%esi,%eiz,1),%esi
> >   804b6b8:       b8 10 00 00 00          mov    $0x10,%eax
> >   804b6bd:       c3                      ret
> >   804b6be:       66 90                   xchg   %ax,%ax

> > If you look closely enough, you'll notice a C2 byte in add $0x3e,%edx
> > instruction on address 804b6a6. The function will assume this byte is
> > a RET instruction, return a size that's 22 bytes too short and then
> > the code execution inside the executable buffer will run past the end
> > of buffer, resulting in a segfault.

Martin, thanks a lot for debugging!

Acked-by: Petr Vorel <pvorel@suse.cz>

Other option would be to disable this test only for 32bit (keep it for 64bit).
Li, any change you could have look into it?

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp