elf-linux-user: segfault caused by invalid loaddr extracted by the ELF loader
Host environment
- Operating system: NixOS 22.05
- OS/kernel version: Linux kurosaki 5.15.85 #1-NixOS SMP Wed Dec 21 16:36:38 UTC 2022 x86_64 GNU/Linux
- Architecture:
x86_64
- QEMU flavor:
qemu-x86_64
- QEMU version: latest master
- QEMU command line:
./qemu-x86_64 simple
Emulated/Virtualized environment
- Operating system: NixOS 22.05
- OS/kernel version: Linux kurosaki 5.15.85 #1-NixOS SMP Wed Dec 21 16:36:38 UTC 2022 x86_64 GNU/Linux
- Architecture:
x86_64
Description of problem
Emulating ELF binaries as emitted by Zig may lead to segfault in QEMU, which typically looks like this
$ qemu-x86_64 simple
fish: Job 1, 'qemu-x86_64 simple' terminated by signal SIGSEGV (Address boundary error)
Steps to reproduce
- Obtain latest Zig nightly
- Compile simple static C program using Zig's ELF linker:
$ echo "int main() { return 0 };" > simple.c
$ zig build-exe simple.c -lc -target x86_64-linux-musl -fno-lld --image-base 0x1000000
$ qemu-x86_64 simple
fish: Job 1, 'qemu-x86_64 simple' terminated by signal SIGSEGV (Address boundary error)
Additional information
Note that running simple
directly it's correctly mmaped and executed by the kernel:
$ ./simple
$ echo $status
0
The reason this happens is because of an assumption QEMU's ELF loader makes on the virtual addresses and offsets of PT_LOAD
segments, namely:
vaddr2 - vaddr1 >= off2 - off1
Typically, to the best of my knowledge, this is conformed to by the linkers in the large, but it is not required at all. Here's a one-line tweak to QEMU's loader that fixes the segfault:
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index f21e2e0c3d..eabb4fed03 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -3211,7 +3211,7 @@ static void load_elf_image(const char *image_name, int image_fd,
for (i = 0; i < ehdr->e_phnum; ++i) {
struct elf_phdr *eppnt = phdr + i;
if (eppnt->p_type == PT_LOAD) {
- abi_ulong a = eppnt->p_vaddr - eppnt->p_offset;
+ abi_ulong a = eppnt->p_vaddr & ~(eppnt->p_align - 1);
if (a < loaddr) {
loaddr = a;
}
The reason why this breaks for ELF binaries emitted by Zig is that while virtual addresses are allocated sequentially or pre-allocated, file offsets are allocated on a best-effort basis wherever there is enough space in the file to fit a given section/segment so that we can move the contents in file while preserving the allocated virtual addresses on a whim. To provide a more concrete example, here's the load segment layout for simple
as emitted by Zig:
$ readelf -l simple
Elf file type is EXEC (Executable file)
Entry point 0x1002000
There are 7 program headers, starting at offset 64
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
PHDR 0x0000000000000040 0x0000000001000040 0x0000000001000040
0x0000000000000188 0x0000000000000188 R 0x8
LOAD 0x0000000000000000 0x0000000001000000 0x0000000001000000
0x00000000000001c8 0x00000000000001c8 R 0x1000
LOAD 0x0000000000021000 0x0000000001001000 0x0000000001001000
0x0000000000000078 0x0000000000000078 R 0x1000
LOAD 0x0000000000022000 0x0000000001002000 0x0000000001002000
0x000000000000065a 0x000000000000065a R E 0x1000
LOAD 0x0000000000023000 0x0000000001003000 0x0000000001003000
0x0000000000000060 0x0000000000000278 RW 0x1000
GNU_EH_FRAME 0x0000000000021064 0x0000000001001064 0x0000000001001064
0x0000000000000014 0x0000000000000014 R 0x4
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RW 0x1
Section to Segment mapping:
Segment Sections...
00
01
02 .rodata.str1.1 .rodata .eh_frame .eh_frame_hdr
03 .text .init .fini
04 .data .got .bss
05 .eh_frame_hdr
06
As you can see, initially loaddr := 0x1000000 - 0x0 = 0x1000000
. However, upon iterating over the second load segment, we already get
a := 0x1001000 - 0x21000 = 0xfe000
and since a < loaddr
, we incorrectly set loaddr := 0xfe000
.