Puthiyaparambil, Aravindh
2006-May-31 17:53 UTC
[Xen-devel] Malformed image causing builder to crash
An image with VIRT_START and ELF_PADDR_OFFSET equal to 0 and its linker entry at 0xffffffff80000000 (Is this is an malformed image?) causes the builder to crash in loadelfimage() [line 235] because parray is going out of bounds. Output from the builder is show below. What seems to be happening is that in setup_guest(), the variable v_end is becoming zero after the "for ( nr_pt_pages = 2; ; nr_pt_pages++ )" loop. Also note that the value of nr_pt_pages is very large. The reason is that dsi->v_start is 0 which throws things off. But this is totally valid so I am not sure what checks need to be introduced to stop this from happening. Should the bounds check for the array be reintroduced? Thanks, Aravindh Puthiyaparambil Xen Development Team Unisys, Tredyffrin PA AP: kernstart: ffffffff80000000 kernend: ffffffff8001b4a0 dsi->v_kernentry: ffffffff80000000 dsi->v_start: 0, dsi->v_end: ffffffff8001b4a0 AP: v_end: ffffffff8002f000 before loop AP: After loop v_end: 0 nr_pages: 8192 nr_pt_pages: 523089 VIRTUAL MEMORY ARRANGEMENT: Loaded kernel: 0xffffffff80000000->0xffffffff8001b4a0 Phys-Mach map: 0xffffffff8001c000 Start info: 0xffffffff8002c000 Store page: 0xffffffff8002d000 Console page: 0xffffffff8002e000 Page tables: 0xffffffff8002f000 Boot stack: 0xffffffffffb80000 TOTAL: (nil)->(nil) ENTRY ADDRESS: 0xffffffff80000000 AP: Before xc_map Segmentation fault _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel
Keir Fraser
2006-Jun-01 10:13 UTC
[Xen-devel] Re: Malformed image causing builder to crash
On 31 May 2006, at 18:53, Puthiyaparambil, Aravindh wrote:> An image with VIRT_START and ELF_PADDR_OFFSET equal to 0 and its linker > entry at 0xffffffff80000000 (Is this is an malformed image?) causes the > builder to crash in loadelfimage() [line 235] because parray is going > out of bounds. Output from the builder is show below. What seems to be > happening is that in setup_guest(), the variable v_end is becoming zero > after the "for ( nr_pt_pages = 2; ; nr_pt_pages++ )" loop. Also note > that the value of nr_pt_pages is very large. The reason is that > dsi->v_start is 0 which throws things off. But this is totally valid so > I am not sure what checks need to be introduced to stop this from > happening. Should the bounds check for the array be reintroduced?The problem is almost certainly a wrap in xc_linux_build.c:setup_guest(). v_end is taken from parseelfimage() and then incremented to make room for initrd, page tables, etc. If that wraps round to zero then the size check will pass and things will generally be screwed. We probably need to take care whenever we increment v_end to ensure that ''inc < -v_end''. -- Keir _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel