Open TheBrokenRail opened 1 year ago
Shifting sections to lower addresses is indeed unintended. Maybe some rounding error?
Could you test if this is still reproducible after https://github.com/NixOS/patchelf/pull/415 being merged?
Sorry for the very late response, but I tested the latest master
, and the issue seems to still be occurring.
For instance:
# readelf of the unmodified binary
$ readelf -lw minecraft-pi-old
Elf file type is EXEC (Executable file)
Entry point 0x12360
There are 8 program headers, starting at offset 52
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
EXIDX 0x11c2ec 0x001242ec 0x001242ec 0x085e0 0x085e0 R 0x4
PHDR 0x000034 0x00008034 0x00008034 0x00100 0x00100 R E 0x4
INTERP 0x000134 0x00008134 0x00008134 0x00019 0x00019 R 0x1
[Requesting program interpreter: /lib/ld-linux-armhf.so.3]
LOAD 0x000000 0x00008000 0x00008000 0x1248d0 0x1248d0 R E 0x8000
LOAD 0x125000 0x00135000 0x00135000 0x0138c 0x50be0 RW 0x8000
DYNAMIC 0x125638 0x00135638 0x00135638 0x00140 0x00140 RW 0x4
NOTE 0x000150 0x00008150 0x00008150 0x00044 0x00044 R 0x4
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4
Section to Segment mapping:
Segment Sections...
00 .ARM.exidx
01
02 .interp
03 .interp .note.ABI-tag .note.gnu.build-id .hash .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .ARM.extab .ARM.exidx .eh_frame
04 .init_array .fini_array .jcr .data.rel.ro .dynamic .got .data .bss
05 .dynamic
06 .note.ABI-tag .note.gnu.build-id
07
Contents of the .eh_frame section:
00000000 ZERO terminator
# readelf of the modified binary
$ readelf -lw minecraft-pi
Elf file type is EXEC (Executable file)
Entry point 0x12360
There are 10 program headers, starting at offset 52
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x00007034 0x00007034 0x00140 0x00140 R E 0x4
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4
LOAD 0x000000 0x00007000 0x00007000 0x05498 0x05498 RW 0x1000
INTERP 0x000174 0x00007174 0x00007174 0x00019 0x00019 R 0x1
[Requesting program interpreter: /lib/ld-linux-armhf.so.3]
NOTE 0x000190 0x00007190 0x00007190 0x00020 0x00020 R 0x4
NOTE 0x0001b0 0x000071b0 0x000071b0 0x00024 0x00024 R 0x4
DYNAMIC 0x0044e4 0x0000b4e4 0x0000b4e4 0x00148 0x00148 RW 0x4
LOAD 0x005498 0x0000c498 0x0000c498 0x120438 0x120438 R E 0x1000
EXIDX 0x11d2ec 0x001242ec 0x001242ec 0x085e0 0x085e0 R 0x4
LOAD 0x126000 0x00135000 0x00135000 0x0138c 0x50be0 RW 0x1000
Section to Segment mapping:
Segment Sections...
00
01
02 .interp .note.ABI-tag .note.gnu.build-id .hash .gnu.hash .dynsym .dynstr .dynamic
03 .interp
04 .note.ABI-tag
05 .note.gnu.build-id
06 .dynamic
07 .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .ARM.extab .ARM.exidx .eh_frame
08 .ARM.exidx
09 .init_array .fini_array .jcr .data.rel.ro .got .data .bss
Contents of the .eh_frame section:
00000000 ZERO terminator
Note the the virtual address of the first LOAD
segment still decreased.
Describe the bug
If you run
--add-needed
on certain executables, it can decrease the address of the first page to belowvm.mmap_min_addr
, meaning that when it runs, you'll only getSegmentation fault
.Steps To Reproduce
sudo sysctl vm.mmap_min_addr=32768
(Default value on Ubuntu 20.04 ARM64)patchelf --add-needed libtest.so minecraft-pi
Segmentation fault
(it'll also refuse to core dump). If you run it with/lib/ld-linux-armhf.so.3
directly, you'll get a more detailed error offailed to map segment from shared object
.sudo sysctl vm.mmap_min_addr=0
Expected behavior
Running
--add-needed
doesn't mess with the address of the first page.patchelf --version
outputAdditional context
Running
strace
on/lib/ld-linux-armhf.so.3
with the modified binary gives me:And running
strace
on/lib/ld-linux-armhf.so.3
with the original binary and filtering formmap2
gives me:I'm not entirely sure that "the address of the first page" is the right terminology. I chose it because it's what PatchELF called
0x8000
(on the original) and0x7000
(on the modified) in the debug info. And those happen to be the same addresses that either succeed (the original) or fail (the modified) to map.Here's the debug info when modifying the binary:
And here's the log when running it a second time:
Notice that the "first page" value has decreased by
0x1000
.