Re: [PATCH 2/2] elf: Detect PT_LOAD segments that extend beyond EOF and refuse loading

[Florian Weimer <fweimer@redhat.com>]

* H. J. Lu:

> On Fri, Nov 5, 2021 at 7:41 AM Florian Weimer <fweimer@redhat.com> wrote:
>>
>> * H. J. Lu:
>>
>> > So dlopen should reject it.   Can you identify the broken tools which
>> > generate such input files and black list them for this test?
>>
>> It's objcopy --only-keep-debug, and it behaves as expted Separated
>> debuginfo is broken by design.  The program headers do not correspond to
>> the file contents, but match the original ELF file.
>
> So the current checks aren't sufficient and your patch also checks
> file size.  On x86-64, where is the first failed check? Why doesn't it
> need to check file size?

Excellent question.  I should have checked this as the first thing.

On x86-64, dlopen fails with “tst-debug1mod1.so: object file has no
dynamic section.”  This is because the file size is 0:

  Type           Offset   VirtAddr           PhysAddr           FileSiz  MemSiz   Flg Align
  DYNAMIC        0x000df8 0x0000000000003e10 0x0000000000003e10 0x000000 0x0001d0 RW  0x8

The dynamic segment has file size zero on aarch64, as well.  But
_dl_map_segments is called before the l->l_ld check in
_dl_map_object_from_fd.  Due to 64 KiB page alignment, it is more likely
that we hit the memset call there to clear a partially mapped page,
hence the crash.

We I think we can move the l->l_ld check earlier and avoid the crash.
I'll send a completely different patch.

Thanks,
Florian