From owner-svn-src-head@freebsd.org Sun Mar 12 13:51:14 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id EBE07D0909D; Sun, 12 Mar 2017 13:51:14 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id A02CF18EC; Sun, 12 Mar 2017 13:51:14 +0000 (UTC) (envelope-from kib@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v2CDpDRg070987; Sun, 12 Mar 2017 13:51:13 GMT (envelope-from kib@FreeBSD.org) Received: (from kib@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v2CDpDWe070986; Sun, 12 Mar 2017 13:51:13 GMT (envelope-from kib@FreeBSD.org) Message-Id: <201703121351.v2CDpDWe070986@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: kib set sender to kib@FreeBSD.org using -f From: Konstantin Belousov Date: Sun, 12 Mar 2017 13:51:13 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r315157 - head/sys/kern X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Mar 2017 13:51:15 -0000 Author: kib Date: Sun Mar 12 13:51:13 2017 New Revision: 315157 URL: https://svnweb.freebsd.org/changeset/base/315157 Log: Accept linkers representation for ELF segments with zero on-disk length. For such segments, GNU bfd linker writes knowingly incorrect value into the the file offset field of the program header entry, with the motivation that file should not be mapped for creation of this segment at all. Relax checks for the ELF structure validity when on-disk segment length is zero, and explicitely set mapping length to zero for such segments to avoid validating rounding arithmetic. PR: 217610 Reported by: Robert Clausecker Sponsored by: The FreeBSD Foundation MFC after: 1 week Modified: head/sys/kern/imgact_elf.c Modified: head/sys/kern/imgact_elf.c ============================================================================== --- head/sys/kern/imgact_elf.c Sun Mar 12 13:49:42 2017 (r315156) +++ head/sys/kern/imgact_elf.c Sun Mar 12 13:51:13 2017 (r315157) @@ -522,7 +522,8 @@ __elfN(load_section)(struct image_params * While I'm here, might as well check for something else that * is invalid: filsz cannot be greater than memsz. */ - if ((off_t)filsz + offset > imgp->attr->va_size || filsz > memsz) { + if ((filsz != 0 && (off_t)filsz + offset > imgp->attr->va_size) || + filsz > memsz) { uprintf("elf_load_section: truncated ELF file\n"); return (ENOEXEC); } @@ -538,7 +539,9 @@ __elfN(load_section)(struct image_params * early and copy the initialized data into that first page. We * choose the second. */ - if (memsz > filsz) + if (filsz == 0) + map_len = 0; + else if (memsz > filsz) map_len = trunc_page_ps(offset + filsz, pagesize) - file_addr; else map_len = round_page_ps(offset + filsz, pagesize) - file_addr; @@ -570,7 +573,8 @@ __elfN(load_section)(struct image_params * segment in the file is extended to provide bss. It's a neat idea * to try and save a page, but it's a pain in the behind to implement. */ - copy_len = (offset + filsz) - trunc_page_ps(offset + filsz, pagesize); + copy_len = filsz == 0 ? 0 : (offset + filsz) - trunc_page_ps(offset + + filsz, pagesize); map_addr = trunc_page_ps((vm_offset_t)vmaddr + filsz, pagesize); map_len = round_page_ps((vm_offset_t)vmaddr + memsz, pagesize) - map_addr;