diff mbox series

[RFC] elfload: Fix alignment when unmapping excess reservation

Message ID 20250213143558.10504-1-farosas@suse.de (mailing list archive)
State New
Headers show
Series [RFC] elfload: Fix alignment when unmapping excess reservation | expand

Commit Message

Fabiano Rosas Feb. 13, 2025, 2:35 p.m. UTC
When complying with the alignment requested in the ELF and unmapping
the excess reservation, having align_end not aligned to the guest page
causes the unmap to be rejected by the alignment check at
target_munmap and later brk adjustments hit an EEXIST.

Fix by aligning the start of region to be unmapped.

Fixes: c81d1fafa6 ("linux-user: Honor elf alignment when placing images")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1913
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
In the bug there was mention of the vdso landing in the wrong spot,
but I don't see evidence of this in my testing. Looking at the
addresses in the bug report, there seems to have been a mistake
because I don't see an overlap there either.
---
 linux-user/elfload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Richard Henderson Feb. 15, 2025, 7:06 p.m. UTC | #1
On 2/13/25 06:35, Fabiano Rosas wrote:
> When complying with the alignment requested in the ELF and unmapping
> the excess reservation, having align_end not aligned to the guest page
> causes the unmap to be rejected by the alignment check at
> target_munmap and later brk adjustments hit an EEXIST.
> 
> Fix by aligning the start of region to be unmapped.
> 
> Fixes: c81d1fafa6 ("linux-user: Honor elf alignment when placing images")
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1913
> Signed-off-by: Fabiano Rosas <farosas@suse.de>
> ---
> In the bug there was mention of the vdso landing in the wrong spot,
> but I don't see evidence of this in my testing. Looking at the
> addresses in the bug report, there seems to have been a mistake
> because I don't see an overlap there either.
> ---
>   linux-user/elfload.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/linux-user/elfload.c b/linux-user/elfload.c
> index a2c152e5ad..05ee5e74fd 100644
> --- a/linux-user/elfload.c
> +++ b/linux-user/elfload.c
> @@ -3351,7 +3351,7 @@ static void load_elf_image(const char *image_name, const ImageSource *src,
>   
>       if (align_size != reserve_size) {
>           abi_ulong align_addr = ROUND_UP(load_addr, align);
> -        abi_ulong align_end = align_addr + reserve_size;
> +        abi_ulong align_end = TARGET_PAGE_ALIGN(align_addr + reserve_size);
>           abi_ulong load_end = load_addr + align_size;

Both align_end and load_end must be aligned.

r~
Richard Henderson Feb. 15, 2025, 7:08 p.m. UTC | #2
On 2/15/25 11:06, Richard Henderson wrote:
> On 2/13/25 06:35, Fabiano Rosas wrote:
>> When complying with the alignment requested in the ELF and unmapping
>> the excess reservation, having align_end not aligned to the guest page
>> causes the unmap to be rejected by the alignment check at
>> target_munmap and later brk adjustments hit an EEXIST.
>>
>> Fix by aligning the start of region to be unmapped.
>>
>> Fixes: c81d1fafa6 ("linux-user: Honor elf alignment when placing images")
>> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1913
>> Signed-off-by: Fabiano Rosas <farosas@suse.de>
>> ---
>> In the bug there was mention of the vdso landing in the wrong spot,
>> but I don't see evidence of this in my testing. Looking at the
>> addresses in the bug report, there seems to have been a mistake
>> because I don't see an overlap there either.
>> ---
>>   linux-user/elfload.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/linux-user/elfload.c b/linux-user/elfload.c
>> index a2c152e5ad..05ee5e74fd 100644
>> --- a/linux-user/elfload.c
>> +++ b/linux-user/elfload.c
>> @@ -3351,7 +3351,7 @@ static void load_elf_image(const char *image_name, const 
>> ImageSource *src,
>>       if (align_size != reserve_size) {
>>           abi_ulong align_addr = ROUND_UP(load_addr, align);
>> -        abi_ulong align_end = align_addr + reserve_size;
>> +        abi_ulong align_end = TARGET_PAGE_ALIGN(align_addr + reserve_size);
>>           abi_ulong load_end = load_addr + align_size;
> 
> Both align_end and load_end must be aligned.

Bah, hit ctrl-enter, not enter.  I'll fix and queue.


r~
Michael Tokarev Feb. 19, 2025, 7:42 a.m. UTC | #3
13.02.2025 17:35, Fabiano Rosas wrote:
> When complying with the alignment requested in the ELF and unmapping
> the excess reservation, having align_end not aligned to the guest page
> causes the unmap to be rejected by the alignment check at
> target_munmap and later brk adjustments hit an EEXIST.
> 
> Fix by aligning the start of region to be unmapped.
> 
> Fixes: c81d1fafa6 ("linux-user: Honor elf alignment when placing images")
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1913
> Signed-off-by: Fabiano Rosas <farosas@suse.de>

Is this a qemu-stable material?  That issue was quite hot..

Thanks,

/mjt
Fabiano Rosas Feb. 19, 2025, 1:05 p.m. UTC | #4
Michael Tokarev <mjt@tls.msk.ru> writes:

> 13.02.2025 17:35, Fabiano Rosas wrote:
>> When complying with the alignment requested in the ELF and unmapping
>> the excess reservation, having align_end not aligned to the guest page
>> causes the unmap to be rejected by the alignment check at
>> target_munmap and later brk adjustments hit an EEXIST.
>> 
>> Fix by aligning the start of region to be unmapped.
>> 
>> Fixes: c81d1fafa6 ("linux-user: Honor elf alignment when placing images")
>> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1913
>> Signed-off-by: Fabiano Rosas <farosas@suse.de>
>
> Is this a qemu-stable material?  That issue was quite hot..

Yes, I think it's good for stable.

>
> Thanks,
>
> /mjt
diff mbox series

Patch

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index a2c152e5ad..05ee5e74fd 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -3351,7 +3351,7 @@  static void load_elf_image(const char *image_name, const ImageSource *src,
 
     if (align_size != reserve_size) {
         abi_ulong align_addr = ROUND_UP(load_addr, align);
-        abi_ulong align_end = align_addr + reserve_size;
+        abi_ulong align_end = TARGET_PAGE_ALIGN(align_addr + reserve_size);
         abi_ulong load_end = load_addr + align_size;
 
         if (align_addr != load_addr) {