public inbox for glibc-bugs@sourceware.org help / color / mirror / Atom feed
From: "cvs-commit at gcc dot gnu.org" <sourceware-bugzilla@sourceware.org> To: glibc-bugs@sourceware.org Subject: [Bug dynamic-link/31218] PLT rewrite overflows large displacement on x32 Date: Sat, 06 Jan 2024 22:26:19 +0000 [thread overview] Message-ID: <bug-31218-131-9rOi32E7fK@http.sourceware.org/bugzilla/> (raw) In-Reply-To: <bug-31218-131@http.sourceware.org/bugzilla/> https://sourceware.org/bugzilla/show_bug.cgi?id=31218 --- Comment #2 from Sourceware Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by H.J. Lu <hjl@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0f9afc265a4a0f4ba658d7f71c9602a3fda3538e commit 0f9afc265a4a0f4ba658d7f71c9602a3fda3538e Author: H.J. Lu <hjl.tools@gmail.com> Date: Sat Jan 6 14:03:37 2024 -0800 x32: Handle displacement overflow in PLT rewrite [BZ #31218] PLT rewrite calculated displacement with ElfW(Addr) disp = value - branch_start - JMP32_INSN_SIZE; On x32, displacement from 0xf7fbe060 to 0x401030 was calculated as unsigned int disp = 0x401030 - 0xf7fbe060 - 5; with disp == 0x8442fcb and caused displacement overflow. The PLT entry was changed to: 0xf7fbe060 <+0>: e9 cb 2f 44 08 jmp 0x401030 0xf7fbe065 <+5>: cc int3 0xf7fbe066 <+6>: cc int3 0xf7fbe067 <+7>: cc int3 0xf7fbe068 <+8>: cc int3 0xf7fbe069 <+9>: cc int3 0xf7fbe06a <+10>: cc int3 0xf7fbe06b <+11>: cc int3 0xf7fbe06c <+12>: cc int3 0xf7fbe06d <+13>: cc int3 0xf7fbe06e <+14>: cc int3 0xf7fbe06f <+15>: cc int3 x32 has 32-bit address range, but it doesn't wrap address around at 4GB, JMP target was changed to 0x100401030 (0xf7fbe060LL + 0x8442fcbLL + 5), which is above 4GB. Always use uint64_t to calculate displacement. This fixes BZ #31218. Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com> -- You are receiving this mail because: You are on the CC list for the bug.
next prev parent reply other threads:[~2024-01-06 22:26 UTC|newest] Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top 2024-01-06 17:06 [Bug dynamic-link/31218] New: PLT rewrite doesn't work on unrelocated definition hjl.tools at gmail dot com 2024-01-06 18:59 ` [Bug dynamic-link/31218] " hjl.tools at gmail dot com 2024-01-06 22:07 ` [Bug dynamic-link/31218] PLT rewrite overflows large displacement on x32 hjl.tools at gmail dot com 2024-01-06 22:26 ` cvs-commit at gcc dot gnu.org [this message] 2024-01-06 22:26 ` hjl.tools at gmail dot com
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-31218-131-9rOi32E7fK@http.sourceware.org/bugzilla/ \ --to=sourceware-bugzilla@sourceware.org \ --cc=glibc-bugs@sourceware.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).