[Bug dynamic-link/32763] New: Static PIE with more than one PT_LOAD segments at offset 0 segfault

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=32763

            Bug ID: 32763
           Summary: Static PIE with more than one PT_LOAD segments at
                    offset 0 segfault
           Product: glibc
           Version: 2.41
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: hjl.tools at gmail dot com
  Target Milestone: ---

As shown in

https://sourceware.org/bugzilla/show_bug.cgi?id=32761

linker may generate more than one PT_LOAD segments at offset 0

Elf file type is DYN (Position-Independent Executable file)
Entry point 0x7170
There are 13 program headers, starting at offset 64

Program Headers:
  Type           Offset             VirtAddr           PhysAddr
                 FileSiz            MemSiz              Flags  Align
  LOAD           0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x00000000001c8801 0x00000000001c8801  R E    0x1000
  LOAD           0x00000000001c9000 0x00000000001c9000 0x00000000001c9000
                 0x00000000000fa130 0x00000000000fa130  R      0x1000
  LOAD           0x00000000002c32f0 0x00000000002c42f0 0x00000000002c42f0
                 0x00000000000e8944 0x00000000000e8944  RW     0x1000
  LOAD           0x0000000000000000 0x00000000003b0000 0x00000000003b0000
                 0x0000000000000000 0x0000000000b5dce8  RW     0x10000
  DYNAMIC        0x00000000003a3768 0x00000000003a4768 0x00000000003a4768
                 0x00000000000001d0 0x00000000000001d0  RW     0x8
  NOTE           0x0000000000000318 0x0000000000000318 0x0000000000000318
                 0x0000000000000024 0x0000000000000024  R      0x4
  NOTE           0x00000000002c30d0 0x00000000002c30d0 0x00000000002c30d0
                 0x0000000000000040 0x0000000000000040  R      0x8
  NOTE           0x00000000002c3110 0x00000000002c3110 0x00000000002c3110
                 0x0000000000000020 0x0000000000000020  R      0x4
  TLS            0x00000000002c32f0 0x00000000002c42f0 0x00000000002c42f0
                 0x0000000000000070 0x00000000000001a0  R      0x8
  GNU_PROPERTY   0x00000000002c30d0 0x00000000002c30d0 0x00000000002c30d0
                 0x0000000000000040 0x0000000000000040  R      0x8
  GNU_EH_FRAME   0x0000000000278900 0x0000000000278900 0x0000000000278900
                 0x000000000000afdc 0x000000000000afdc  R      0x4
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RW     0x10
  GNU_RELRO      0x00000000002c32f0 0x00000000002c42f0 0x00000000002c42f0
                 0x00000000000e0d10 0x00000000000e0d10  R      0x1

 Section to Segment mapping:
  Segment Sections...
   00     .note.gnu.build-id .init .plt .plt.got .text .fini
   01     .gnu.hash .dynsym .dynstr .rela.dyn .rela.plt .rodata .stapsdt.base
rodata.cst32 .eh_frame_hdr .eh_frame .gcc_except_table .note.gnu.property
.note.ABI-tag
   02     .tdata .init_array .fini_array .data.rel.ro .dynamic .got .got.plt
.data
   03     .bss
   04     .dynamic
   05     .note.gnu.build-id
   06     .note.gnu.property
   07     .note.ABI-tag
   08     .tdata .tbss
   09     .note.gnu.property
   10     .eh_frame_hdr
   11
   12     .tdata .init_array .fini_array .data.rel.ro .dynamic .got

_dl_relocate_static_pie has

  for (ph = phdr; ph < &phdr[phnum]; ++ph)
    switch (ph->p_type)
      {   
      case PT_LOAD:
        if (ph->p_offset == 0)
          file_p_vaddr = ph->p_vaddr;
        break;
      case PT_DYNAMIC:
        main_map->l_ld_readonly = (ph->p_flags & PF_W) == 0;
        break;
      default:
        break;
      }   

It uses the last PT_LOAD segment at offset 0 for the static PIE address
and causes such static PIE binary to segfault.

-- 
You are receiving this mail because:
You are on the CC list for the bug.