Hi Mark,

在 2023/5/22 05:14, Mark Wielaard 写道:
> Hi Ying,
>
> On Tue, May 16, 2023 at 03:34:01PM +0800, Ying Huang wrote:
>> 在 2023/5/16 14:46, Ying Huang 写道:
>>>>> libelf/elf_getdata.c: Some eu-utils use read-mmap method to map file,
>>>>> so we need to malloc and memcpy raw data to avoid segment fault. After
>>>>> modification, the correct value are saved in the malloced memory not in
>>>>> process address space.
>>>> Where do these segfaults show up?
>>>     The screenshot of the segment error was not uploaded successfully in the last email, upload again.
> Sorry, the mailinglist seems to strip the image attachements.
>
>> huangying@Sleepygon:~/elf/elfutils_4$ src/elflint src/nm.o
>> Segmentation fault
>> huangying@Sleepygon:~/elf/elfutils_4$ src/elflint src/strip.o
>> Segmentation fault
> When running under gdb, what is the backtrace of the crash?
>
> Thanks,
>
> Mark

huangying@Sleepygon:~/elf/elfutils_4$ src/elflint src/nm.o

Segmentation fault (core dumped)

huangying@Sleepygon:~/elf/elfutils_4$ gdb src/elflint

...

(gdb) bt
#0  convert_data (type=ELF_T_RELA, size=24912, data=1, eclass=<optimized out>, scn=0xaad3698f98) at elf_getdata.c:254
#1  __libelf_set_data_list_rdlock (scn=0xaad3698f98, wrlocked=<optimized out>) at elf_getdata.c:515
#2  0x000000fff3862f14 in __elf_getdata_rdlock (scn=0xaad3698f98, data=<optimized out>) at elf_getdata.c:622
#3  0x000000fff3862f54 in elf_getdata (scn=<optimized out>, data=<optimized out>) at elf_getdata.c:640
#4  0x000000aaac571c9c in check_rela (ebl=0xaad369b120, ehdr=0xfffb9451b0, shdr=0xfffb945008, idx=<optimized out>) at elflint.c:1500
#5  0x000000aaac574e40 in check_sections (ebl=0xaad369b120, ehdr=0xfffb9451b0) at elflint.c:4198
#6  0x000000aaac5784ac in process_elf_file (only_one=<optimized out>, size=<optimized out>, fname=<optimized out>, suffix=<optimized out>, prefix=<optimized out>, elf=<optimized out>) at elflint.c:4842
#7  process_file (fd=<optimized out>, elf=<optimized out>, prefix=<optimized out>, suffix=<optimized out>, fname=<optimized out>, size=<optimized out>, only_one=<optimized out>) at elflint.c:241
#8  0x000000aaac5688fc in main (argc=<optimized out>, argv=0xfffb9455d8) at elflint.c:174

...


    If I did not malloc to scn->data_base, would occur Segment fault when we want to operate this space "&scn->data_list.data.d". Because src/elflint use read-mmap method to map file.

    Show 10 lines of code "libelf/elf_getdata.c" starting at line 254:

huangying@Sleepygon:~/elf/elfutils_4$ cat libelf/elf_getdata.c | tail -n +254 | head -n 10
            for (int cnt = 0; cnt < nentries; cnt++)
              {
            Elf_Data_Scn *data_scn = (Elf_Data_Scn *) &scn->data_list.data.d;
                Elf64_Rela *value = &((Elf64_Rela *) data_scn->d.d_buf)[cnt];
                Elf64_Xword info = value->r_info;
                value->r_info = (((info & 0xffffffff) << 32)
                       | ((info >> 56) & 0xff)
                   | ((info >> 40) & 0xff00)
                   | ((info >> 24) & 0xff0000)
                   | ((info >> 8) & 0xff000000));


    Show elflint map method in src/elflint.c:

    /* Create an `Elf' descriptor. */

    Elf *elf = elf_begin (fd, ELF_C_READ_MMAP, NULL);


Thanks,

Ying