Re: [PATCH] elf: Check invalid hole in PT_LOAD segments [BZ #28838]

[Michael Hudson-Doyle <michael.hudson@canonical.com>]

On Tue, 1 Feb 2022 at 04:24, H.J. Lu <hjl.tools@gmail.com> wrote:

> commit 163f625cf9becbb82dfec63a29e566324129c0cd
> Author: H.J. Lu <hjl.tools@gmail.com>
> Date:   Tue Dec 21 12:35:47 2021 -0800
>
>     elf: Remove excessive p_align check on PT_LOAD segments [BZ #28688]
>
> removed the p_align check against the page size.  It caused the loader
> crash in shared objects with the invalid p_align.  Update _dl_map_segments
> to detect invalid holes.  This fixes BZ #28838.
>

I am not competent to have an opinion on the correctness of the change, but
the test passes on Launchapd's i386 and amd64 builders with it.

Cheers,
mwh


> ---
>  elf/dl-map-segments.h | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/elf/dl-map-segments.h b/elf/dl-map-segments.h
> index 172692b120..fd24cf5d01 100644
> --- a/elf/dl-map-segments.h
> +++ b/elf/dl-map-segments.h
> @@ -113,6 +113,9 @@ _dl_map_segments (struct link_map *l, int fd,
>               unallocated.  Then jump into the normal segment-mapping loop
> to
>               handle the portion of the segment past the end of the file
>               mapping.  */
> +         if (__glibc_unlikely (loadcmds[nloadcmds - 1].mapstart <
> +                               c->mapend))
> +           return N_("ELF load command address/offset not page-aligned");
>            if (__glibc_unlikely
>                (__mprotect ((caddr_t) (l->l_addr + c->mapend),
>                             loadcmds[nloadcmds - 1].mapstart - c->mapend,
> --
> 2.34.1
>
>