From c791d16b7dcf9d985ebe0e852481142753603353 Mon Sep 17 00:00:00 2001
From: Aaron Merey <amerey@redhat.com>
Date: Fri, 8 Dec 2023 16:44:35 -0500
Subject: [PATCH] libdwfl: Correctly handle corefile non-contiguous segments
It is possible for segments of different shared libaries to be interleaved
in memory such that the segments of one library are located in between
non-contiguous segments of another library.
For example, this can be seen with firefox on RHEL 7.9 where multiple
shared libraries could be mapped in between ld-2.17.so segments:
[...]
7f0972082000-7f09720a4000 00000000 139264 /usr/lib64/ld-2.17.so
7f09720a4000-7f09720a5000 00000000 4096 /memfd:mozilla-ipc (deleted)
7f09720a5000-7f09720a7000 00000000 8192 /memfd:mozilla-ipc (deleted)
7f09720a7000-7f09720a9000 00000000 8192 /memfd:mozilla-ipc (deleted)
7f0972134000-7f0972136000 00000000 8192 /usr/lib64/firefox/libmozwayland.so
7f0972136000-7f0972137000 00002000 4096 /usr/lib64/firefox/libmozwayland.so
7f0972137000-7f0972138000 00003000 4096 /usr/lib64/firefox/libmozwayland.so
7f0972138000-7f0972139000 00003000 4096 /usr/lib64/firefox/libmozwayland.so
7f097213a000-7f0972147000 00000000 53248 /usr/lib64/firefox/libmozsqlite3.so
7f0972147000-7f097221e000 0000d000 880640 /usr/lib64/firefox/libmozsqlite3.so
7f097221e000-7f0972248000 000e4000 172032 /usr/lib64/firefox/libmozsqlite3.so
7f0972248000-7f0972249000 0010e000 4096 /usr/lib64/firefox/libmozsqlite3.so
7f0972249000-7f097224c000 0010e000 12288 /usr/lib64/firefox/libmozsqlite3.so
7f097224c000-7f0972250000 00111000 16384 /usr/lib64/firefox/libmozsqlite3.so
7f0972250000-7f0972253000 00000000 12288 /usr/lib64/firefox/liblgpllibs.so
[...]
7f09722a3000-7f09722a4000 00021000 4096 /usr/lib64/ld-2.17.so
7f09722a4000-7f09722a5000 00022000 4096 /usr/lib64/ld-2.17.so
dwfl_segment_report_module did not account for the possibility of
interleaving non-contiguous segments, resulting in premature closure
of modules as well as failing to report modules.
Fix this by removing segment skipping in dwfl_segment_report_module.
When dwfl_segment_report_module reported a module, it would return
the index of the segment immediately following the end address of the
current module. Since there's a chance that other modules might fall
within this address range, dwfl_segment_report_module instead returns
the index of the next segment.
This patch also fixes premature module closure that can occur in
dwfl_segment_report_module when interleaving non-contiguous segments
are found. Previously modules with start and end addresses that overlap
with the current segment would have their build-ids compared with the
current segment's build-id. If there was a mismatch, that module would
be closed. Avoid closing modules in this case when mismatching build-ids
correspond to distinct modules.
https://sourceware.org/bugzilla/show_bug.cgi?id=30975
Signed-off-by: Aaron Merey <amerey@redhat.com>
---
libdwfl/dwfl_segment_report_module.c | 37 +++++++++----
tests/Makefile.am | 8 ++-
tests/dwfl-core-noncontig.c | 82 ++++++++++++++++++++++++++++
tests/run-dwfl-core-noncontig.sh | 63 +++++++++++++++++++++
4 files changed, 176 insertions(+), 14 deletions(-)
create mode 100644 tests/dwfl-core-noncontig.c
create mode 100755 tests/run-dwfl-core-noncontig.sh
diff --git a/libdwfl/dwfl_segment_report_module.c b/libdwfl/dwfl_segment_report_module.c
index 3ef62a7..09ee37b 100644
--- a/libdwfl/dwfl_segment_report_module.c
+++ b/libdwfl/dwfl_segment_report_module.c
@@ -737,17 +737,34 @@ dwfl_segment_report_module (Dwfl *dwfl, int ndx, const char *name,
&& invalid_elf (module->elf, module->disk_file_has_build_id,
&build_id))
{
- elf_end (module->elf);
- close (module->fd);
- module->elf = NULL;
- module->fd = -1;
+ /* If MODULE's build-id doesn't match the disk file's
+ build-id, close ELF only if MODULE and ELF refer to
+ different builds of files with the same name. This
+ prevents premature closure of the correct ELF in cases
+ where segments of a module are non-contiguous in memory. */
+ if (name != NULL && module->name[0] != '\0'
+ && strcmp (basename (module->name), basename (name)) == 0)
+ {
+ elf_end (module->elf);
+ close (module->fd);
+ module->elf = NULL;
+ module->fd = -1;
+ }
}
- if (module->elf != NULL)
+ else if (module->elf != NULL)
{
- /* Ignore this found module if it would conflict in address
- space with any already existing module of DWFL. */
+ /* This module has already been reported. */
skip_this_module = true;
}
+ else
+ {
+ /* Only report this module if we haven't already done so. */
+ for (Dwfl_Module *mod = dwfl->modulelist; mod != NULL;
+ mod = mod->next)
+ if (mod->low_addr == module_start
+ && mod->high_addr == module_end)
+ skip_this_module = true;
+ }
}
if (skip_this_module)
goto out;
@@ -781,10 +798,6 @@ dwfl_segment_report_module (Dwfl *dwfl, int ndx, const char *name,
}
}
- /* Our return value now says to skip the segments contained
- within the module. */
- ndx = addr_segndx (dwfl, segment, module_end, true);
-
/* Examine its .dynamic section to get more interesting details.
If it has DT_SONAME, we'll use that as the module name.
If it has a DT_DEBUG, then it's actually a PIE rather than a DSO.
@@ -929,6 +942,8 @@ dwfl_segment_report_module (Dwfl *dwfl, int ndx, const char *name,
ndx = -1;
goto out;
}
+ else
+ ndx++;
/* We have reported the module. Now let the caller decide whether we
should read the whole thing in right now. */
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 7fb8efb..9f8f769 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -42,7 +42,7 @@ check_PROGRAMS = arextract arsymtest newfile saridx scnnames sectiondump \
dwfl-bug-addr-overflow arls dwfl-bug-fd-leak \
dwfl-addr-sect dwfl-bug-report early-offscn \
dwfl-bug-getmodules dwarf-getmacros dwarf-ranges addrcfi \
- dwarfcfi \
+ dwfl-core-noncontig dwarfcfi \
test-flag-nobits dwarf-getstring rerequest_tag \
alldts typeiter typeiter2 low_high_pc \
test-elf_cntl_gelf_getshdr dwflsyms dwfllines \
@@ -212,7 +212,7 @@ TESTS = run-arextract.sh run-arsymtest.sh run-ar.sh newfile test-nlist \
$(asm_TESTS) run-disasm-bpf.sh run-low_high_pc-dw-form-indirect.sh \
run-nvidia-extended-linemap-libdw.sh run-nvidia-extended-linemap-readelf.sh \
run-readelf-dw-form-indirect.sh run-strip-largealign.sh \
- run-readelf-Dd.sh
+ run-readelf-Dd.sh run-dwfl-core-noncontig.sh
if !BIARCH
export ELFUTILS_DISABLE_BIARCH = 1
@@ -632,7 +632,8 @@ EXTRA_DIST = run-arextract.sh run-arsymtest.sh run-ar.sh \
run-nvidia-extended-linemap-libdw.sh run-nvidia-extended-linemap-readelf.sh \
testfile_nvidia_linemap.bz2 \
testfile-largealign.o.bz2 run-strip-largealign.sh \
- run-funcretval++11.sh
+ run-funcretval++11.sh \
+ run-dwfl-core-noncontig.sh testcore-noncontig.bz2
if USE_VALGRIND
@@ -738,6 +739,7 @@ dwfl_bug_fd_leak_LDADD = $(libeu) $(libdw) $(libebl) $(libelf)
dwfl_bug_report_LDADD = $(libdw) $(libebl) $(libelf)
dwfl_bug_getmodules_LDADD = $(libeu) $(libdw) $(libebl) $(libelf)
dwfl_addr_sect_LDADD = $(libeu) $(libdw) $(libebl) $(libelf) $(argp_LDADD)
+dwfl_core_noncontig_LDADD = $(libdw) $(libelf)
dwarf_getmacros_LDADD = $(libdw)
dwarf_ranges_LDADD = $(libdw)
dwarf_getstring_LDADD = $(libdw)
diff --git a/tests/dwfl-core-noncontig.c b/tests/dwfl-core-noncontig.c
new file mode 100644
index 0000000..04558e2
--- /dev/null
+++ b/tests/dwfl-core-noncontig.c
@@ -0,0 +1,82 @@
+/* Test program for dwfl_getmodules bug.
+ Copyright (C) 2008 Red Hat, Inc.
+ This file is part of elfutils.
+
+ This file is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ elfutils is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>. */
+
+#include <config.h>
+#include <stdio.h>
+#include <fcntl.h>
+#include <assert.h>
+#include ELFUTILS_HEADER(dwfl)
+#include ELFUTILS_HEADER(elf)
+
+static const Dwfl_Callbacks cb =
+{
+ NULL,
+ NULL,
+ NULL,
+ NULL,
+};
+
+int
+main (int argc, char **argv)
+{
+ assert (argc == 2);
+
+ Dwfl *dwfl = dwfl_begin (&cb);
+
+ int fd = open (argv[1], O_RDONLY);
+ assert (fd != -1);
+
+ Elf *elf = elf_begin (fd, ELF_C_READ, NULL);
+ (void) dwfl_core_file_report (dwfl, elf, argv[0]);
+
+ /* testcore-noncontig contains a shared library mapped between
+ non-contiguous segments of another shared library:
+
+ [...]
+ 7f14e458c000-7f14e45ae000 00000000 139264 /usr/lib64/ld-2.17.so (1)
+ 7f14e4795000-7f14e4798000 00000000 12288 /usr/lib64/firefox/liblgpllibs.so (2)
+ 7f14e4798000-7f14e479d000 00003000 20480 /usr/lib64/firefox/liblgpllibs.so
+ 7f14e479d000-7f14e479f000 00008000 8192 /usr/lib64/firefox/liblgpllibs.so
+ 7f14e479f000-7f14e47a0000 00009000 4096 /usr/lib64/firefox/liblgpllibs.so
+ 7f14e47a0000-7f14e47a1000 0000a000 4096 /usr/lib64/firefox/liblgpllibs.so (3)
+ 7f14e47ad000-7f14e47ae000 00021000 4096 /usr/lib64/ld-2.17.so (4)
+ 7f14e47ae000-7f14e47af000 00022000 4096 /usr/lib64/ld-2.17.so */
+
+ /* First segment of the non-contiguous module (1). */
+ int seg = dwfl_addrsegment (dwfl, 0x7f14e458c000, NULL);
+ assert (seg == 32);
+
+ /* First segment of the module within the non-contiguous module's address
+ range (2). */
+ seg = dwfl_addrsegment (dwfl, 0x7f14e4795000, NULL);
+ assert (seg == 33);
+
+ /* Last segment of the module within the non-contiguous module's
+ address range (3). */
+ seg = dwfl_addrsegment (dwfl, 0x7f14e47a0000, NULL);
+ assert (seg == 37);
+
+ /* First segment of non-contiguous module following its address space
+ gap (4). */
+ seg = dwfl_addrsegment (dwfl, 0x7f14e47ad000, NULL);
+ assert (seg == 40);
+
+ dwfl_end (dwfl);
+ elf_end (elf);
+
+ return 0;
+}
diff --git a/tests/run-dwfl-core-noncontig.sh b/tests/run-dwfl-core-noncontig.sh
new file mode 100755
index 0000000..1245b67
--- /dev/null
+++ b/tests/run-dwfl-core-noncontig.sh
@@ -0,0 +1,63 @@
+#! /bin/sh
+# Copyright (C) 2023 Red Hat, Inc.
+# This file is part of elfutils.
+#
+# This file is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# elfutils is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+. $srcdir/test-subr.sh
+
+# Test whether libdwfl can handle corefiles containing non-contiguous
+# segments where multiple modules are contained within the address
+# space of some other module.
+
+# testcore-noncontig was generated from the following program with
+# systemd-coredump on RHEL 7.9 Workstation, kernel
+# 3.10.0-1160.105.1.el7.x86_64. liblgpllibs.so was packaged with
+# firefox-115.4.0-1.el7_9.x86_64.rpm.
+
+# #include <unistd.h>
+# #include <dlfcn.h>
+#
+# int main () {
+# dlopen ("/usr/lib64/firefox/liblgpllibs.so", RTLD_GLOBAL | RTLD_NOW);
+# sleep (60);
+# return 0;
+# }
+#
+# gcc -ldl -o test test.c
+
+tempfiles out
+testfiles testcore-noncontig
+
+testrun ${abs_builddir}/dwfl-core-noncontig testcore-noncontig
+
+# Remove parts of the output that could change depending on which
+# libraries are locally installed.
+testrun ${abs_top_builddir}/src/unstrip -n --core testcore-noncontig \
+ | sed 's/+/ /g' | cut -d " " -f1,3 | sort > out
+
+testrun_compare cat out <<\EOF
+0x400000 3a1748a544b40a38b3be3d2d13ffa34a2a5a71c0@0x400284
+0x7f14e357e000 edf51350c7f71496149d064aa8b1441f786df88a@0x7f14e357e1d8
+0x7f14e3794000 7615604eaf4a068dfae5085444d15c0dee93dfbd@0x7f14e37941d8
+0x7f14e3a96000 09cfb171310110bc7ea9f4476c9fa044d85baff4@0x7f14e3a96210
+0x7f14e3d9e000 e10cc8f2b932fc3daeda22f8dac5ebb969524e5b@0x7f14e3d9e248
+0x7f14e3fba000 fc4fa58e47a5acc137eadb7689bce4357c557a96@0x7f14e3fba280
+0x7f14e4388000 7f2e9cb0769d7e57bd669b485a74b537b63a57c4@0x7f14e43881d8
+0x7f14e458c000 62c449974331341bb08dcce3859560a22af1e172@0x7f14e458c1d8
+0x7f14e4795000 175efdcef445455872a86a6fbee7567ca16a513e@0x7f14e4795248
+0x7ffcfe59f000 80d79b32785868a2dc10047b39a80d1daec8923d@0x7ffcfe59f328
+EOF
+
+exit 0
--
2.43.0