Subject: Re: va 0 mapped - NULL pointer dereference succeeds
To: Charles M. Hannum <abuse@spamalicious.com>
From: Simon Burge <simonb@wasabisystems.com>
List: port-mips
Date: 10/25/2003 22:32:01
On Fri, Oct 24, 2003 at 05:40:43PM +0000, Charles M. Hannum wrote:
> On Friday 24 October 2003 05:31 pm, Matthias Drochner wrote:
> > Hi -
> > on a pmax/-current, compiled with gcc3, I'm observing
> >
> > # pmap
> > 00000000 52K read/exec /libexec/ld.elf_so
> > 0000D000 252K [ anon ]
> > 0004C000 8K read/write [ anon ]
> > 00400000 208K read/exec /bin/csh
> > [...]
> >
> > And indeed, a small (dynamically linked) test program can read
> > from NULL, gets the contents of /libexec/ld.elf_so as expected.
> >
> > This shouldn't happen...
>
> MIPS is still defining ELF_INTERP_NON_RELOCATABLE, a vestige from before I
> made ld.elf_so relocatable on that platform. My guess is that a newer
> version of binutils stopped linking it with the traditional VA offset
> (0x5ffe0000), and so now it's mapping at 0.
>
> Either the ld scripts should be fixed to use the old offset, or
> ELF_INTERP_NON_RELOCATABLE should be removed, or both. It certainly makes no
> sense as is.
As Matthias mentioned, ld.elf_so is still linked at 0x5ffe0000 (for
reasons I can't find - a long while ago I tried at VA offset 0 and
everything still seemed to work fine).
With the trailing patch, patch and COMPAT_16 I see:
rhone 2> ./null
foo = 0x0
*foo = 0x464c457f
rhone 3>
and without COMPAT_16 I see:
rhone 2> ./null
foo = 0x0
Segmentation fault (core dumped)
Exit 139
rhone 3>
and pmap says:
rhone 1> pmap
00400000 524K read/exec /usr/pkg/bin/tcsh
10000000 12K read/write /usr/pkg/bin/tcsh
10003000 508K read/write [ anon ]
30000000 52K read/exec /libexec/ld.elf_so
3000D000 252K [ anon ]
3004C000 4K read/write /libexec/ld.elf_so
3004D000 8K read/write [ anon ]
3004F000 4K read/exec [ uvm_aobj ]
30050000 32K read/write [ anon ]
...
Look OK to commit?
Simon.
--
Simon Burge <simonb@wasabisystems.com>
NetBSD Development, Support and Service: http://www.wasabisystems.com/
Index: elf_machdep.h
===================================================================
RCS file: /cvsroot/src/sys/arch/mips/include/elf_machdep.h,v
retrieving revision 1.8
diff -d -p -u -r1.8 elf_machdep.h
--- elf_machdep.h 9 Dec 2001 23:05:58 -0000 1.8
+++ elf_machdep.h 25 Oct 2003 12:11:03 -0000
@@ -86,10 +86,15 @@
#define DT_MIPS_HIPAGENO 0x70000014
#define DT_MIPS_RLD_MAP 0x70000016 /* address of loader map */
+#ifdef _KERNEL
+#ifdef _KERNEL_OPT
+#include "opt_compat_netbsd.h"
+#endif
+#ifdef COMPAT_16
/*
* Tell the kernel ELF exec code not to try relocating the interpreter
* (ld.so) for dynamically-linked ELF binaries.
*/
-#ifdef _KERNEL
#define ELF_INTERP_NON_RELOCATABLE
-#endif
+#endif /* COMPAT_16 */
+#endif /* _KERNEL */