Commit Graph
8 Commits
Author SHA1 Message Date
Filip Michalski 62e1d3089c fix(relinker): reject unsupported extended program header counts 2026-10-23 20:16:51 +02:00
Dean 00d7e611ef Merge pull request #7363 from plokmklo/fix/relinker-gnu-stack-relro
fix(relinker): synthesise a non-executable PT_GNU_STACK for Linux executables
2026-10-20 03:52:18 +13:00
plokmklo c1866af79b fix(relinker): synthesize PT_GNU_STACK for Linux outputs without one
Outputs whose input carries no PT_GNU_STACK get one appended with
PF_R|PF_W and alignment 16 so the kernel does not fall back to an
executable stack marking.

RequiredProgramHeaderCount and WriteLayout now derive from one shared
header list, so the reserved slot and the written header cannot
disagree at any PhNum boundary, when a free input slot should be
reused, or when the RELRO coverage guard reduces the kept count.
Space exhaustion beyond the 16-bit header limit fails loudly instead
of silently skipping the header.
2026-10-19 07:30:56 +00:00
fogydes 93d3f89b51 fix(relinker): reject program header table overlapping the extra block 2026-10-19 12:21:35 +05:30
m2 (AI Agent) 7f73643e0c test(relinker): name each program-layout check instead of tracking its line 2026-10-15 03:50:14 +02:00
mariuszkreft 58120ca418 fix(relinker): place the Linux extra PT_LOAD past the last guest page
ComputeExtraBlockVaddr kept the ELF congruence p_vaddr == p_offset (mod 0x1000)
and bumped the result by one page only when it fell below the highest guest
load end as a byte address. When that end is not page aligned and the extra
block's file offset remainder reaches it, the extra RWX PT_LOAD landed in the
same 4 KiB page that holds the tail of the highest guest segment. The kernel
maps each PT_LOAD page by page with MAP_FIXED in program-header order, so the
extra block's file page replaced the guest's .data tail and zero-filled .bss
there.

Round the highest kept PT_LOAD end up to the page before adding the offset
remainder, which is the placement GuestModuleWriter::WriteLinux already uses
for the guest module. Only the overlapping case changes; an end that is page
aligned or a remainder below it yields the same address as before.

The extra PT_LOAD now also spans to the end of its own page in p_memsz, so the
page it takes over is fully covered, and its vaddr is derived in WriteLayout
instead of being taken from the request. The header block load carries the
same flags as before.
2026-10-14 01:17:49 +02:00
MrMha 3742fa136e test(relinker): cover extra block bounds and header address overflow 2026-10-11 23:11:42 +04:00
MrMha d85d1c268f fix(relinker): validate program layout ranges before writing 2026-10-11 19:51:17 +04:00