File ipxe.00ff3d8bb3af0831ced99e8b6f226291ca236883.p... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File ipxe.00ff3d8bb3af0831ced99e8b6f226291ca236883.patch of Package xen (Revision 1b049f727c9e7d4aec4eb434d870b455)

Currently displaying revision 1b049f727c9e7d4aec4eb434d870b455 , Show latest

From: Michael Brown <mcb30@ipxe.org>
Date: Tue, 7 Apr 2015 06:40:34 +0100
Subject: 00ff3d8bb3af0831ced99e8b6f226291ca236883

[libc] Fix typo in longjmp()

Commit 8ab4b00 ("[libc] Rewrite setjmp() and longjmp()") introduced a
regression in which the saved values of %ebx, %esi, and %edi were all
accidentally restored into %esp.  The result is that the second and
subsequent returns from setjmp() would effectively corrupt %ebx, %esi,
%edi, and the stack pointer %esp.

Use of setjmp() and longjmp() is generally discouraged: our only use
occurs as part of the implementation of PXENV_RESTART_TFTP, since the
PXE API effectively mandates its use here.  The call to setjmp()
occurs at the start of pxe_start_nbp(), where there are almost
certainly no values held in %ebx, %esi, or %edi.  The corruption of
these registers therefore had no visible effect on program execution.
The corruption of %esp would have been visible on return from
pxe_start_nbp(), but there are no known PXE NBPs which first call
PXENV_RESTART_TFTP and subsequently attempt to return to the PXE base
code.  The effect on program execution was therefore similar to that
of moving the stack to a pseudo-random location in the 32-bit address
space; this will often allow execution to complete successfully since
there is a high chance that the pseudo-random location will be unused.
The regression therefore went undetected for around one month.

Fix by restoring the correct registers from the saved jmp_buf
structure.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---
 src/arch/i386/core/setjmp.S | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/src/arch/i386/core/setjmp.S
+++ b/src/arch/i386/core/setjmp.S
@@ -43,22 +43,22 @@ setjmp:
 longjmp:
 	/* Get jmp_buf pointer in %edx */
 	movl	4(%esp),%edx
 	/* Get result in %eax */
 	movl	8(%esp),%eax
 	/* Force result to non-zero */
 	testl	%eax, %eax
 	jnz	1f
 	incl	%eax
 1:	/* Restore stack pointer */
 	movl	env_stack(%edx), %esp
 	/* Restore other registers */
-	movl	env_ebx(%edx), %esp
-	movl	env_esi(%edx), %esp
-	movl	env_edi(%edx), %esp
+	movl	env_ebx(%edx), %ebx
+	movl	env_esi(%edx), %esi
+	movl	env_edi(%edx), %edi
 	movl	env_ebp(%edx), %ebp
 	/* Replace return address on the new stack */
 	popl	%ecx	/* discard */
 	pushl	env_retaddr(%edx)
 	/* Return to setjmp() caller */
 	ret
 	.size	longjmp, . - longjmp

Places

File ipxe.00ff3d8bb3af0831ced99e8b6f226291ca236883.patch of Package xen (Revision 1b049f727c9e7d4aec4eb434d870b455)

Places