In kernel 2.4.3 and 2.2.18, there is a bug in fs/binfmt_elf.c function
load_elf_binary(). An ET_DYN file that asks for a PT_INTERP, and whose
first PT_LOAD is not at 0, gets AT_PHDR that is (load_bias + 2 * p_vaddr),
instead of the correct (load_bias + p_vaddr). The patch for 2.4.3 is
--- fs/OLDbinfmt_elf.c Mon Mar 19 17:05:16 2001
+++ fs/binfmt_elf.c Sat Jun 2 16:20:54 2001
@@ -632,5 +632,5 @@
load_bias += error -
ELF_PAGESTART(load_bias + vaddr);
- load_addr += error;
+ load_addr += load_bias;
}
}
=
Please cc: me if appropriate; I'm not subscribed.
To demonstrate the problem on i386:
cat foo.s EOF
.section .interp
.asciz /tmp/ld-linux.so.2
.text
_start: .weak _start
main: .weak main
foo:
jmp foo
EOF
gcc -nostartfiles -o foo.so foo.s
# Now, binary edit foo.so to change Elf32_Ehdr.e_type from ET_EXEC to ET_DYN.
# The 'short' at file offset 0x10 goes from 2 to 3.
cp /lib/ld-linux.so.2 /tmp
# Now, binary edit /tmp/ld-linux.so.2 so that it begins with an infinite loop.
# objdump -f gives the entry address. (short)0xfeeb is an infinite loop.
nice ldd foo.so # Here is the failure. Start in background at low priority.
cat /proc/pid_of_foo.so/maps # I see pid_of_foo.so = 2 + pid_of_nice
# output:
# 88048000-88049000 r-xp 03:07 2207 foo.so # load_bias is 0x8000
# 88049000-8804a000 rw-p 03:07 2207 foo.so
gdb foo.so pid_of_foo.so # Attach to process, and look at its memory.
x/64x $esp # and continue until seeing the AT_* on the stack. I see
# 0xba90: 0xbfe8 0x 0x0003 0x90090034
# 0xbaa0: 0x0004 0x0020 0x0005 0x0005
# 0xbab0: 0x0006 0x1000 0x0007 0x4000
# 0xbac0: 0x0008 0x 0x0009 0x88048114
# which shows AT_PHDR at 0xba9c of 0x90090034
# which is too big by 0x08048000 [p_vaddr of first PT_LOAD]
# because the correct value is 0x88048034.
# Note that AT_ENTRY at 0xbacc is 0x88048114 which is correct.
--
John Reiser, [EMAIL PROTECTED]
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
