Re: [PATCH] fs/binfmt_elf: use ELF_ET_DYN_BASE for PIE (ET_DYN with INTERP) binaries

[Azat Khuzhin]

On Mon, Jan 31, 2022 at 01:30:38PM -0800, H.J. Lu wrote:
> On Mon, Jan 31, 2022 at 12:17 PM Azat Khuzhin <a3at.mail@xxxxxxxxx> wrote:
> >
> > Since 9630f0d60fec ELF_ET_DYN_BASE is not used as a load_bias anymore
> > and this breaks PIE binaries, since after this change data segment
> > became too nearby the stack:
> >
> > Before 9630f0d60fec:
> >
> >     $ strace -febrk /tmp/test-stack |& head
> >     brk(NULL)                               = 0x555555559000
> >     $ /tmp/test-stack
> >     bottom_of_stack = 0x7fffffffc5c0
> >     recursion depth: 1 (stack diff: 32)
> >     ...
> >     recursion depth: 7690 (stack diff: 8365664)
> >     Segmentation fault (core dumped)
> >
> > After 9630f0d60fec:
> >
> >     $ strace -ebrk /tmp/test-stack  |& head
> >     brk(NULL)                               = 0x7ffff7fff000
> >
> >     $ /tmp/test-stack
> >     bottom_of_stack = 0x7fffffffc640
> >     recursion depth: 1 (stack diff: 32)
> >     ...
> >     recursion depth: 146 (stack diff: 157792)
> >     Segmentation fault (core dumped)
> >
> > Found this during compiling with clang, that started to randomly
> > SIGSEGV when it eats some heap.
> 
> How do I reproduce it on x86-64?

It fails for me for pretty big C++ unit, so I don't have a simple
reproducer with clang, but the attached reproducer below should show the
problem.

> > Reproducer:
> >
> >     #include <stdio.h>
> >     #include <stddef.h>
> >     #include <stdlib.h>
> >
> >     static int depth = 0;
> >     static void* bottom_of_stack;
> >
> >     int inner()
> >     {
> >         char buffer[1024];
> >         ptrdiff_t diff;
> >         int ret;
> >
> >         ++depth;
> >         diff = bottom_of_stack - __builtin_frame_address(0);
> >
> >         fprintf(stderr,
> >                 "recursion depth: %i (stack diff: %zu)\n",
> >                 depth, (size_t)diff);
> >
> >         for (size_t i = 0; i < 1024; ++i)
> >                 ret += buffer[i];
> >
> >         ret += inner();
> >
> >         return ret;
> >     }
> >
> >     int main()
> >     {
> >         for (size_t size = 0; size < 128<<20; size += 16<<10)
> >                 malloc(16<<10);
> >
> >         bottom_of_stack = __builtin_frame_address(0);
> >         fprintf(stderr, "bottom_of_stack = %p\n", bottom_of_stack);
> >         inner();
> >     }