Attached elf.zip crash reproducer.
Loading the executable with readelf
reveals mmap
fails:
Warning: Dynamic ELF object has no interpreter path. Using: /usr/lib/Loader.so
mmap reservation: Bad address
ASSERTION FAILED: false
../../Userland/Libraries/LibELF/DynamicLoader.cpp:308
Hitting VERIFY_NOT_REACHED()
in DynamicLoader
:
serenity/Userland/Libraries/LibELF/DynamicLoader.cpp
Lines 305 to 309 in e0b6cfe
Where as executing the executable crashes the system:
[#0 Shell(30:30)]: exec(./orc/orc_2694): WARNING - Dynamic ELF executable without a PT_INTERP header, and isn't /usr/lib/Loader.so
[Shell(30:30)]: ASSERTION FAILED: m_total_range.contains(allocated_range)
[Shell(30:30)]: ../../Kernel/VM/RangeAllocator.cpp:145 in AK::Optional<Kernel::Range> Kernel::RangeAllocator::allocate_specific(VirtualAddress, size_t)
[#0 Shell(30:30)]: 0xc05d3be0 abort +0x4b
[#0 Shell(30:30)]: 0xc05c6f29 __assertion_failed(char const*, char const*, unsigned int, char const*) +0xd5
[#0 Shell(30:30)]: 0xc0588ee0 Kernel::RangeAllocator::allocate_specific(VirtualAddress, unsigned long) +0xf8
[#0 Shell(30:30)]: 0xc05a1001 Kernel::Space::allocate_range(VirtualAddress, unsigned long, unsigned long) +0x1e9
[#0 Shell(30:30)]: 0xc0408075 Kernel::load_elf_object(AK::NonnullOwnPtr<Kernel::Space>, Kernel::FileDescription&, unsigned int, Kernel::ShouldAllocateTls, Kernel::ShouldAllowSyscalls) +0x2017
[#0 Shell(30:30)]: 0xc0409ef2 Kernel::Process::load(AK::NonnullRefPtr<Kernel::FileDescription>, AK::RefPtr<Kernel::FileDescription, AK::RefPtrTraits<Kernel::FileDescription> >, elfhdr const&) +0x9ac
[#0 Shell(30:30)]: 0xc040c04f Kernel::Process::do_exec(AK::NonnullRefPtr<Kernel::FileDescription>, AK::Vector<AK::String, 0ul>, AK::Vector<AK::String, 0ul>, AK::RefPtr<Kernel::FileDescription, AK::RefPtrTraits<Kernel::FileDescription> >, Kernel::Thread*&, unsigned int&, elfhdr const&) +0x134f
[#0 Shell(30:30)]: 0xc0415789 Kernel::Process::exec(AK::String, AK::Vector<AK::String, 0ul>, AK::Vector<AK::String, 0ul>, int) [clone .part.0] +0x1d1f
[#0 Shell(30:30)]: 0xc0417a13 Kernel::Process::sys$execve(AK::Userspace<Kernel::Syscall::SC_execve_params const*>) +0xee9
[#0 Shell(30:30)]: 0xc03ec580 syscall_handler +0x1e7d
[#0 Shell(30:30)]: 0xc03ea6cb syscall_asm_entry +0x31
GNU readelf offers some hints:
$ readelf -l Base/home/anon/orc/orc_2694
Elf file type is DYN (Shared object file)
Entry point 0x31f7
There are 5 program headers, starting at offset 52
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x00000034 0x00000034 0x000a0 0x000a0 R 0x4
readelf: Error: the PHDR segment is not covered by a LOAD segment
PHDR 0x0000d4 0x000000d4 0x000000d4 0x00013 0x00013 R 0x1
readelf: Error: the PHDR segment is not covered by a LOAD segment
LOAD 0x000000 0xc0000000 0x80008beb 0x05c60 0x05c60 0x1000
LOAD 0x005c60 0x00006c60 0x00006c60 0x00358 0x0037c RW 0x1000
DYNAMIC 0x005d2c 0x00006d2c 0x00006d2c 0x00130 0x00130 RW 0x4
Section to Segment mapping:
Segment Sections...
00
01
02
03 .dynamic .data
04
readelf: Warning: Virtual address 0xc24 not located in any PT_LOAD segment.
$ readelf -s Base/home/anon/orc/orc_2694
readelf: Error: the PHDR segment is not covered by a LOAD segment
readelf: Error: the PHDR segment is not covered by a LOAD segment
readelf: Warning: Virtual address 0xc24 not located in any PT_LOAD segment.
Symbol table '.dynsym' contains 156 entries:
Num: Value Size Type Bind Vis Ndx Name
[...]
Symbol table '.symtab' contains 253 entries:
Num: Value Size Type Bind Vis Ndx Name
readelf: Error: Reading 32767 bytes extends past end of file for string table
0: 00000000 0 NOTYPE LOCAL DEFAULT UND <corrupt>
1: 000000d4 0x80000000 SECTION LOCAL PROTECTED [<other>: 7c] 2 <corrupt>
2: 000000e8 0 SECTION LOCAL DEFAULT 2 <corrupt>
3: 00000264 0 SECTION LOCAL DEFAULT 3 <corrupt>
4: 00000c24 0 SECTION LOCAL DEFAULT 4 <corrupt>
[...]
Pay now to fund the work behind this issue.
Get updates on progress being made.
Maintainer is rewarded once the issue is completed.
You're funding impactful open source efforts
You want to contribute to this effort
You want to get funding like this too