llvm / llvm/llvm-project

[BOLT] [hugify] PIE binary crashes on kernels below 5.10

Open
#201,813 2 comments 0 reactions 0 assignees View on GitHub
BOLT
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

The modified hugify test (pie only) crashes with segfault due to unexpected segment alignment.
The segfault occurs because the right side of a hugified area isn’t mapped into a process address space.
Affected kernel versions are below 5.10 which doesn't include the patch https://github.com/torvalds/linux/commit/ce81bb256a22 .

Test setup
- Env: Ubuntu 18.04, linux kernel 5.4
- Enabled debug logs in hugify.cpp (ENABLE_DEBUG)

GDB logs:

(gdb) r

Starting program: /home/dm/hugify_test/hugify.c.tmp.pie
[hugify] hot start: 555555f54000
[hugify] hot end: 5555561531a9
[hugify] aligned huge page from: 555555e00000
[hugify] aligned huge page to: 555556200000
[hugify] workaround with memory alignment for kernel < 5.10
[hugify] allocated temporary address: 7ffff75e2000
[hugify] allocated size: 400000

Program received signal SIGSEGV, Segmentation fault.
0x0000555556154460 in ?? ()
(gdb) info proc
process 3067
cmdline = '/home/dm/hugify_test/hugify.c.tmp.pie'
cwd = '/home/dm/hugify_test'
exe = '/home/dm/hugify_test/hugify.c.tmp.pie'
(gdb) shell cat /proc/3067/maps
555555554000-555555754000 r-xp 00000000 08:01 2493742 /home/dm/hugify_test/hugify.c.tmp.pie
555555953000-555555954000 r--p 001ff000 08:01 2493742 /home/dm/hugify_test/hugify.c.tmp.pie
555555954000-555555955000 rw-p 00200000 08:01 2493742 /home/dm/hugify_test/hugify.c.tmp.pie
555555d54000-555556156000 r-xp 00800000 08:01 2493742 /home/dm/hugify_test/hugify.c.tmp.pie
7ffff75e2000-7ffff79e2000 rw-p 00000000 00:00 0
7ffff79e2000-7ffff7bc9000 r-xp 00000000 08:01 2621522 /lib/x86_64-linux-gnu/libc-2.27.so
7ffff7bc9000-7ffff7dc9000 ---p 001e7000 08:01 2621522 /lib/x86_64-linux-gnu/libc-2.27.so
7ffff7dc9000-7ffff7dcd000 r--p 001e7000 08:01 2621522 /lib/x86_64-linux-gnu/libc-2.27.so
7ffff7dcd000-7ffff7dcf000 rw-p 001eb000 08:01 2621522 /lib/x86_64-linux-gnu/libc-2.27.so
7ffff7dcf000-7ffff7dd3000 rw-p 00000000 00:00 0
7ffff7dd3000-7ffff7dfc000 r-xp 00000000 08:01 2621446 /lib/x86_64-linux-gnu/ld-2.27.so
7ffff7fe1000-7ffff7fe3000 rw-p 00000000 00:00 0
7ffff7ff7000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00029000 08:01 2621446 /lib/x86_64-linux-gnu/ld-2.27.so
7ffff7ffd000-7ffff7ffe000 rw-p 0002a000 08:01 2621446 /lib/x86_64-linux-gnu/ld-2.27.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0 [stack]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0 [vsyscall]
(gdb)

readelf output (readelf -lW hugify.c.tmp.pie)

Elf file type is DYN (Position-Independent Executable file)

Entry point 0xc00fa0
There are 10 program headers, starting at offset 8388608

Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x800000 0x0000000000800000 0x0000000000800000 0x000230 0x000230 R 0x8
INTERP 0x000238 0x0000000000000238 0x0000000000000238 0x00001c 0x00001c R 0x1
[Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
LOAD 0x000000 0x0000000000000000 0x0000000000000000 0x1ff868 0x1ff868 R E 0x200000
LOAD 0x1ffdb8 0x00000000003ffdb8 0x00000000003ffdb8 0x000258 0x000260 RW 0x200000
LOAD 0x800000 0x0000000000800000 0x0000000000800000 0x401304 0x401304 R E 0x200000
DYNAMIC 0x1ffdc8 0x00000000003ffdc8 0x00000000003ffdc8 0x0001f0 0x0001f0 RW 0x8
NOTE 0x000254 0x0000000000000254 0x0000000000000254 0x000044 0x000044 R 0x4
GNU_EH_FRAME 0xc012a0 0x0000000000c012a0 0x0000000000c012a0 0x000064 0x000064 R 0x4
GNU_STACK 0x000000 0x0000000000000000 0x0000000000000000 0x000000 0x000000 RW 0x10
GNU_RELRO 0x1ffdb8 0x00000000003ffdb8 0x00000000003ffdb8 0x000248 0x000248 R 0x1

Section to Segment mapping:
Segment Sections...
00
01 .interp
02 .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .plt.got .bolt.org.text .fini .rodata .bolt.org.eh_frame_hdr .bolt.org.eh_frame
03 .init_array .fini_array .dynamic .got .data .bss
04 .text .text.injected .eh_frame .text.bolt.extra.1 .rodata.str1.1.bolt.extra.1 .rodata.str1.8.bolt.extra.1 .note.gnu.property.bolt.extra.1 .eh_frame.bolt.extra.1 .eh_frame_hdr
05 .dynamic
06 .note.ABI-tag .note.gnu.build-id
07 .eh_frame_hdr
08
09 .init_array .fini_array .dynamic .got

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.