mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

linux-user: Fixes for zero_bss

Browse Source 
The previous change, 2d385be615, assumed !PAGE_VALID meant that
the page would be unmapped by the elf image.  However, since we
reserved the entire image space via mmap, PAGE_VALID will always
be set.  Instead, assume PROT_NONE for the same condition.

Furthermore, assume bss is only ever present for writable segments,
and that there is no page overlap between PT_LOAD segments.
Instead of an assert, return false to indicate failure.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1854
Fixes: 2d385be615 ("linux-user: Do not adjust zero_bss for host page size")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit e6e66b0328)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
Richard Henderson 2023-08-30 13:33:54 -07:00 committed by Michael Tokarev
parent 71452f87c9
commit e73f57b1b5
1 changed files with 40 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
linux-user/elfload.c
View File

@ -2217,31 +2217,58 @@ static abi_ulong setup_arg_pages(struct linux_binprm *bprm,
* Map and zero the bss. We need to explicitly zero any fractional pages * Map and zero the bss. We need to explicitly zero any fractional pages
* after the data section (i.e. bss). Return false on mapping failure. * after the data section (i.e. bss). Return false on mapping failure.
*/ */
static bool zero_bss(abi_ulong start_bss, abi_ulong end_bss, int prot) static bool zero_bss(abi_ulong start_bss, abi_ulong end_bss,
int prot, Error **errp)
{ {
abi_ulong align_bss; abi_ulong align_bss;
/* We only expect writable bss; the code segment shouldn't need this. */
if (!(prot & PROT_WRITE)) {
error_setg(errp, "PT_LOAD with non-writable bss");
return false;
}
align_bss = TARGET_PAGE_ALIGN(start_bss); align_bss = TARGET_PAGE_ALIGN(start_bss);
end_bss = TARGET_PAGE_ALIGN(end_bss); end_bss = TARGET_PAGE_ALIGN(end_bss);
if (start_bss < align_bss) { if (start_bss < align_bss) {
int flags = page_get_flags(start_bss); int flags = page_get_flags(start_bss);
if (!(flags & PAGE_VALID)) { if (!(flags & PAGE_BITS)) {
/* Map the start of the bss. */ /*
* The whole address space of the executable was reserved
* at the start, therefore all pages will be VALID.
* But assuming there are no PROT_NONE PT_LOAD segments,
* a PROT_NONE page means no data all bss, and we can
* simply extend the new anon mapping back to the start
* of the page of bss.
*/
align_bss -= TARGET_PAGE_SIZE; align_bss -= TARGET_PAGE_SIZE;
} else if (flags & PAGE_WRITE) {
/* The page is already mapped writable. */
memset(g2h_untagged(start_bss), 0, align_bss - start_bss);
} else { } else {
/* Read-only zeros? */ /*
g_assert_not_reached(); * The start of the bss shares a page with something.
* The only thing that we expect is the data section,
* which would already be marked writable.
* Overlapping the RX code segment seems malformed.
*/
if (!(flags & PAGE_WRITE)) {
error_setg(errp, "PT_LOAD with bss overlapping "
"non-writable page");
return false;
}
/* The page is already mapped and writable. */
memset(g2h_untagged(start_bss), 0, align_bss - start_bss);
} }
} }
return align_bss >= end_bss || if (align_bss < end_bss &&
target_mmap(align_bss, end_bss - align_bss, prot, target_mmap(align_bss, end_bss - align_bss, prot,
MAP_FIXED | MAP_PRIVATE | MAP_ANON, -1, 0) != -1; MAP_FIXED | MAP_PRIVATE | MAP_ANON, -1, 0) == -1) {
error_setg_errno(errp, errno, "Error mapping bss");
return false;
}
return true;
} }
#if defined(TARGET_ARM) #if defined(TARGET_ARM)
@ -3265,8 +3292,8 @@ static void load_elf_image(const char *image_name, int image_fd,
/* If the load segment requests extra zeros (e.g. bss), map it. */ /* If the load segment requests extra zeros (e.g. bss), map it. */
if (vaddr_ef < vaddr_em && if (vaddr_ef < vaddr_em &&
!zero_bss(vaddr_ef, vaddr_em, elf_prot)) { !zero_bss(vaddr_ef, vaddr_em, elf_prot, &err)) {
goto exit_mmap; goto exit_errmsg;
} }
/* Find the full program boundaries. */ /* Find the full program boundaries. */