[BOLT] [hugify] PIE binary crashes on kernels below 5.10
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
The modified hugify test (pie only) crashes with segfault due to unexpected segment alignment.
The segfault occurs because the right side of a hugified area isn’t mapped into a process address space.
Affected kernel versions are below 5.10 which doesn't include the patch https://github.com/torvalds/linux/commit/ce81bb256a22 .
Test setup
- Env: Ubuntu 18.04, linux kernel 5.4
- Enabled debug logs in hugify.cpp (ENABLE_DEBUG)
GDB logs:
(gdb) r
Starting program: /home/dm/hugify_test/hugify.c.tmp.pie
[hugify] hot start: 555555f54000
[hugify] hot end: 5555561531a9
[hugify] aligned huge page from: 555555e00000
[hugify] aligned huge page to: 555556200000
[hugify] workaround with memory alignment for kernel < 5.10
[hugify] allocated temporary address: 7ffff75e2000
[hugify] allocated size: 400000Program received signal SIGSEGV, Segmentation fault.
0x0000555556154460 in ?? ()
(gdb) info proc
process 3067
cmdline = '/home/dm/hugify_test/hugify.c.tmp.pie'
cwd = '/home/dm/hugify_test'
exe = '/home/dm/hugify_test/hugify.c.tmp.pie'
(gdb) shell cat /proc/3067/maps
555555554000-555555754000 r-xp 00000000 08:01 2493742 /home/dm/hugify_test/hugify.c.tmp.pie
555555953000-555555954000 r--p 001ff000 08:01 2493742 /home/dm/hugify_test/hugify.c.tmp.pie
555555954000-555555955000 rw-p 00200000 08:01 2493742 /home/dm/hugify_test/hugify.c.tmp.pie
555555d54000-555556156000 r-xp 00800000 08:01 2493742 /home/dm/hugify_test/hugify.c.tmp.pie
7ffff75e2000-7ffff79e2000 rw-p 00000000 00:00 0
7ffff79e2000-7ffff7bc9000 r-xp 00000000 08:01 2621522 /lib/x86_64-linux-gnu/libc-2.27.so
7ffff7bc9000-7ffff7dc9000 ---p 001e7000 08:01 2621522 /lib/x86_64-linux-gnu/libc-2.27.so
7ffff7dc9000-7ffff7dcd000 r--p 001e7000 08:01 2621522 /lib/x86_64-linux-gnu/libc-2.27.so
7ffff7dcd000-7ffff7dcf000 rw-p 001eb000 08:01 2621522 /lib/x86_64-linux-gnu/libc-2.27.so
7ffff7dcf000-7ffff7dd3000 rw-p 00000000 00:00 0
7ffff7dd3000-7ffff7dfc000 r-xp 00000000 08:01 2621446 /lib/x86_64-linux-gnu/ld-2.27.so
7ffff7fe1000-7ffff7fe3000 rw-p 00000000 00:00 0
7ffff7ff7000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00029000 08:01 2621446 /lib/x86_64-linux-gnu/ld-2.27.so
7ffff7ffd000-7ffff7ffe000 rw-p 0002a000 08:01 2621446 /lib/x86_64-linux-gnu/ld-2.27.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0 [stack]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0 [vsyscall]
(gdb)
readelf output (readelf -lW hugify.c.tmp.pie)
Elf file type is DYN (Position-Independent Executable file)
Entry point 0xc00fa0
There are 10 program headers, starting at offset 8388608Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x800000 0x0000000000800000 0x0000000000800000 0x000230 0x000230 R 0x8
INTERP 0x000238 0x0000000000000238 0x0000000000000238 0x00001c 0x00001c R 0x1
[Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
LOAD 0x000000 0x0000000000000000 0x0000000000000000 0x1ff868 0x1ff868 R E 0x200000
LOAD 0x1ffdb8 0x00000000003ffdb8 0x00000000003ffdb8 0x000258 0x000260 RW 0x200000
LOAD 0x800000 0x0000000000800000 0x0000000000800000 0x401304 0x401304 R E 0x200000
DYNAMIC 0x1ffdc8 0x00000000003ffdc8 0x00000000003ffdc8 0x0001f0 0x0001f0 RW 0x8
NOTE 0x000254 0x0000000000000254 0x0000000000000254 0x000044 0x000044 R 0x4
GNU_EH_FRAME 0xc012a0 0x0000000000c012a0 0x0000000000c012a0 0x000064 0x000064 R 0x4
GNU_STACK 0x000000 0x0000000000000000 0x0000000000000000 0x000000 0x000000 RW 0x10
GNU_RELRO 0x1ffdb8 0x00000000003ffdb8 0x00000000003ffdb8 0x000248 0x000248 R 0x1Section to Segment mapping:
Segment Sections...
00
01 .interp
02 .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .plt.got .bolt.org.text .fini .rodata .bolt.org.eh_frame_hdr .bolt.org.eh_frame
03 .init_array .fini_array .dynamic .got .data .bss
04 .text .text.injected .eh_frame .text.bolt.extra.1 .rodata.str1.1.bolt.extra.1 .rodata.str1.8.bolt.extra.1 .note.gnu.property.bolt.extra.1 .eh_frame.bolt.extra.1 .eh_frame_hdr
05 .dynamic
06 .note.ABI-tag .note.gnu.build-id
07 .eh_frame_hdr
08
09 .init_array .fini_array .dynamic .got
Contributor guide
Assessment
This issue has not been assessed yet.