Skip to content

Run images whose PT_LOAD covers the low 64 KiB #440

Open

Description

@xalestar

An ET_EXEC whose first PT_LOAD covers VDSO_BASE (0xF000) faults under elfuse. vdso_build writes the vDSO over the image's text at VDSO_BASE, and when the image starts at 0x0, the null page that guest_invalidate_ptes removes also takes its ELF header, so the first access to it faults.

Reproduction: aarch64-linux-gnu-gcc -static -O2 -Wl,-Ttext-segment=0x8000 hello.c (ld rounds the first PT_LOAD to 0x0), then elfuse ./a.out dies with SIGSEGV at 0x40. Linux 6.18 runs the same binary as root, where vm.mmap_min_addr does not apply.

The cause is the fixed VDSO_BASE. Linux places the vDSO in the mmap area, after the image is mapped, so it never collides with a PT_LOAD. Moving it in elfuse touches the shim, the signal trampoline address (VDSO_BASE + VDSO_OFF_SIGRET) and the boot and exec page-table setup. A smaller first step would refuse such an image at load with a clear error instead of faulting after the vDSO has been written over it.

Found while reviewing #435.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions