[Bug 232289] kern/link_elf.c fails for small sections sizes (<sizeof(void *)) (also affects pcpu and vnet)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=232289

            Bug ID: 232289
           Summary: kern/link_elf.c fails for small sections sizes
                    (<sizeof(void *))  (also affects pcpu and vnet)
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs at FreeBSD.org
          Reporter: bz at FreeBSD.org

Hi,

debugging PR230857 I noticed a small problem (here's output from instrumented
kernel) loading a module with a single char variable in a vnet_set and the . =
. + 1 workaround currently in place (hence 2 bytes section size).  The problem
here is count == 0:

XXX-BZ link_elf_lookup_set: count 0 stop 0x1d400000 start 0x1d400000  <<== pcpu
(unused)
XXX-BZ link_elf_lookup_set: count 0 stop 0x1d401272 start 0x1d401270  <<== vnet
XXX-BZ parse_vnet: count 0 start 0x1d401270 stop 0x1d401272
XXX-BZ parse_vnet:682 error = 0
XXX-BZ link_elf_reloc_local:1619 /boot/kernel/z1.ko addr 0x1d400000 rel 0
relsize 0 rela 0 relasize 0

>From elfdump -a /boot/kernel/z1.ko:

entry: 6
        sh_name: set_vnet
        sh_type: SHT_PROGBITS
        sh_flags: SHF_WRITE|SHF_ALLOC
        sh_addr: 0x1270
        sh_offset: 624
        sh_size: 2
        sh_link: 0
        sh_info: 0
        sh_addralign: 1
        sh_entsize: 0

entry: 1
        st_name: __stop_set_vnet
        st_value: 0x1272
        st_size: 0
        st_info: STT_NOTYPE STB_GLOBAL
        st_shndx: 65521

entry: 3
        st_name: ___set_vnet_pad
        st_value: 0x1
        st_size: 0
        st_info: STT_NOTYPE STB_GLOBAL
        st_shndx: 65521

entry: 9
        st_name: __start_set_vnet
        st_value: 0x1270
        st_size: 0
        st_info: STT_NOTYPE STB_GLOBAL
        st_shndx: 65521

entry: 1
        st_name: vnet_entry_achar
        st_value: 0x1270
        st_size: 1
        st_info: STT_OBJECT STB_LOCAL
        st_shndx: 6



sys/kern/link_elf.c:

link_elf_lookup_set() does read the start and stop symbols:

        void **start, **stop;
        int len, error = 0, count;

..
        /* and the number of entries */
        count = stop - start;
        printf("XXX-BZ %s: count %d stop %#jx start %#jx\n", __func__, count,
(uintmax_t)(uintptr_t)stop, (uintmax_t)(uintptr_t)start);


The problem is that the addresses are stored in void ** and so 2 - 0 ! = 2 but
0.

Hence, with the count being 0, so when parse_dpcpu() and parse_vnet() do a
count *= sizeof(void *);  0 * x will stay 0.

So the extra memory allocated in the set handlers will be roundup2(size,
sizeof(void *)) or 0.

Also the copy functions later will copy 0 bytes.

While there is no error, neither the memory needed is allocated, nor the data
needed is copied into the memory area.

With the start/stop symbols stored properly, future relocations would work, the
memory accessed be bogus however.

-- 
You are receiving this mail because:
You are the assignee for the bug.