From 22d113b52f410d345c3a50a00d2eafa64138e427 Mon Sep 17 00:00:00 2001 From: Giuseppe Musacchio Date: Thu, 17 Dec 2020 11:17:40 +0100 Subject: [PATCH] linux-user: Fix loading of BSS segments Some ELF binaries encode the .bss section as an extension of the data ones by setting the segment p_memsz > p_filesz. Some other binaries take a different route and encode it as a stand-alone PT_LOAD segment with p_filesz = 0 and p_memsz > 0. Both the encodings are actually correct per ELF specification but the ELF loader had some troubles in handling the former: with the old logic it was very likely to get Qemu to crash in zero_bss when trying to access unmapped memory. zero_bss isn't meant to allocate whole zero-filled segments but to "complete" a previously mapped segment with the needed zero bits. The fix is pretty simple, if the segment is completely zero-filled we simply allocate one or more pages (according to p_memsz) and avoid calling zero_bss altogether. Signed-off-by: Giuseppe Musacchio Message-Id: Signed-off-by: Laurent Vivier --- linux-user/elfload.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/linux-user/elfload.c b/linux-user/elfload.c index a64050713f..f5bd4076fc 100644 --- a/linux-user/elfload.c +++ b/linux-user/elfload.c @@ -2805,14 +2805,16 @@ static void load_elf_image(const char *image_name, int image_fd, vaddr = load_bias + eppnt->p_vaddr; vaddr_po = TARGET_ELF_PAGEOFFSET(vaddr); vaddr_ps = TARGET_ELF_PAGESTART(vaddr); - vaddr_len = TARGET_ELF_PAGELENGTH(eppnt->p_filesz + vaddr_po); + + vaddr_ef = vaddr + eppnt->p_filesz; + vaddr_em = vaddr + eppnt->p_memsz; /* - * Some segments may be completely empty without any backing file - * segment, in that case just let zero_bss allocate an empty buffer - * for it. + * Some segments may be completely empty, with a non-zero p_memsz + * but no backing file segment. */ if (eppnt->p_filesz != 0) { + vaddr_len = TARGET_ELF_PAGELENGTH(eppnt->p_filesz + vaddr_po); error = target_mmap(vaddr_ps, vaddr_len, elf_prot, MAP_PRIVATE | MAP_FIXED, image_fd, eppnt->p_offset - vaddr_po); @@ -2820,14 +2822,22 @@ static void load_elf_image(const char *image_name, int image_fd, if (error == -1) { goto exit_mmap; } - } - vaddr_ef = vaddr + eppnt->p_filesz; - vaddr_em = vaddr + eppnt->p_memsz; + /* + * If the load segment requests extra zeros (e.g. bss), map it. + */ + if (eppnt->p_filesz < eppnt->p_memsz) { + zero_bss(vaddr_ef, vaddr_em, elf_prot); + } + } else if (eppnt->p_memsz != 0) { + vaddr_len = TARGET_ELF_PAGELENGTH(eppnt->p_memsz + vaddr_po); + error = target_mmap(vaddr_ps, vaddr_len, elf_prot, + MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS, + -1, 0); - /* If the load segment requests extra zeros (e.g. bss), map it. */ - if (vaddr_ef < vaddr_em) { - zero_bss(vaddr_ef, vaddr_em, elf_prot); + if (error == -1) { + goto exit_mmap; + } } /* Find the full program boundaries. */