[Bug 232289] kern/link_elf.c fails for small sections sizes (<sizeof(void *)) (also affects pcpu and vnet)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=232289

--- Comment #1 from commit-hook at freebsd.org ---
A commit references this bug:

Author: bz
Date: Thu Oct 18 20:20:42 UTC 2018
New revision: 339431
URL: https://svnweb.freebsd.org/changeset/base/339431

Log:
  In r78161 the lookup_set linker method was introduced which optionally
  returns the section start and stop locations as well as a count if the
  caller asks for them.
  There was only one out-of-file consumer of count which did not actually
  use it and hence was eliminated in r339407.
  In r194784 parse_dpcpu(), and in r195699 parse_vnet() (a copy of the
  former) started to use the link_elf_lookup_set() interface internally
  also asking for the count.

  count is computed as the difference of the void **stop - void **start
  locations and as such, if the absoulte numbers
        (stop - start) % sizeof(void *) != 0
  a round-down happens, e.g., **stop 0x1003 - **start 0x1000 => count 0.

  To get the section size instead of "count is the number of pointer
  elements in the section", the parse_*() functions do a
        count *= sizeof(void *).
  They use the result to allocate memory and copy the section data
  into the "master" and per-instance memory regions with a size of
  count.

  As a result of count possibly round-down this can miss the last
  bytes of the section.  The good news is that we do not touch
  out of bounds memory during these operations (we may at a later stage
  if the last bytes would overflow the master sections).
  Given relocation in elf_relocaddr() works based on the absolute
  numbers of start and stop, this means that we can possibly try to
  access relocated data which was never copied and hence we get
  random garbage or at best zeroed memory.

  Stop the two (last) consumers of count (the parse_*() functions)
  from using count as well, and calculate the section size based on
  the absolute numbers of stop and start and use the proper size for
  the memory allocation and data copies.  This will make the symbols
  in the last bytes of the pcpu or vnet sections be presented as
  expected.

  PR:                   232289
  Approved by:          re (gjb)
  MFC after:            2 weeks

Changes:
  head/sys/kern/link_elf.c

-- 
You are receiving this mail because:
You are the assignee for the bug.