rtld: Handle ELF dso with program headers outside the first page.

Reported by:	Alex Arslan <alex.arslan@julialang.org>
PR:	229708
Reviewed by:	dim (previous version), emaste
Sponsored by:	The FreeBSD Foundation
Differential revision:	https://reviews.freebsd.org/D26323

1 files changed, 28 insertions, 10 deletions

diff --git a/libexec/rtld-elf/map_object.c b/libexec/rtld-elf/map_object.c
index 24812df6724e..dcd3e21c0501 100644
--- a/libexec/rtld-elf/map_object.c
+++ b/libexec/rtld-elf/map_object.c
@@ -40,11 +40,19 @@
 #include "debug.h"
 #include "rtld.h"
 
-static Elf_Ehdr *get_elf_header(int, const char *, const struct stat *);
+static Elf_Ehdr *get_elf_header(int, const char *, const struct stat *,
+    Elf_Phdr **phdr);
 static int convert_flags(int); /* Elf flags -> mmap flags */
 
 int __getosreldate(void);
 
+static bool
+phdr_in_zero_page(const Elf_Ehdr *hdr)
+{
+	return (hdr->e_phoff + hdr->e_phnum * sizeof(Elf_Phdr) <
+	    (size_t)PAGE_SIZE);
+}
+
 /*
  * Map a shared object into memory.  The "fd" argument is a file descriptor,
  * which must be open on the object and positioned at its beginning.
@@ -95,17 +103,15 @@ map_object(int fd, const char *path, const struct stat *sb)
     size_t note_map_len;
     Elf_Addr text_end;
 
-    hdr = get_elf_header(fd, path, sb);
+    hdr = get_elf_header(fd, path, sb, &phdr);
     if (hdr == NULL)
 	return (NULL);
 
     /*
      * Scan the program header entries, and save key information.
-     *
      * We expect that the loadable segments are ordered by load address.
      */
-    phdr = (Elf_Phdr *)((char *)hdr + hdr->e_phoff);
-    phsize  = hdr->e_phnum * sizeof (phdr[0]);
+    phsize  = hdr->e_phnum * sizeof(phdr[0]);
     phlimit = phdr + hdr->e_phnum;
     nsegs = -1;
     phdyn = phinterp = phtls = NULL;
@@ -332,14 +338,18 @@ error1:
 error:
     if (note_map != NULL && note_map != MAP_FAILED)
 	munmap(note_map, note_map_len);
+    if (!phdr_in_zero_page(hdr))
+	munmap(phdr, hdr->e_phnum * sizeof(phdr[0]));
     munmap(hdr, PAGE_SIZE);
     return (NULL);
 }
 
 static Elf_Ehdr *
-get_elf_header(int fd, const char *path, const struct stat *sbp)
+get_elf_header(int fd, const char *path, const struct stat *sbp,
+    Elf_Phdr **phdr_p)
 {
 	Elf_Ehdr *hdr;
+	Elf_Phdr *phdr;
 
 	/* Make sure file has enough data for the ELF header */
 	if (sbp != NULL && sbp->st_size < (off_t)sizeof(Elf_Ehdr)) {
@@ -388,11 +398,19 @@ get_elf_header(int fd, const char *path, const struct stat *sbp)
 	    "%s: invalid shared object: e_phentsize != sizeof(Elf_Phdr)", path);
 		goto error;
 	}
-	if (hdr->e_phoff + hdr->e_phnum * sizeof(Elf_Phdr) >
-	    (size_t)PAGE_SIZE) {
-		_rtld_error("%s: program header too large", path);
-		goto error;
+	if (phdr_in_zero_page(hdr)) {
+		phdr = (Elf_Phdr *)((char *)hdr + hdr->e_phoff);
+	} else {
+		phdr = mmap(NULL, hdr->e_phnum * sizeof(phdr[0]),
+		    PROT_READ, MAP_PRIVATE | MAP_PREFAULT_READ, fd,
+		    hdr->e_phoff);
+		if (phdr == MAP_FAILED) {
+			_rtld_error("%s: error mapping phdr: %s", path,
+			    rtld_strerror(errno));
+			goto error;
+		}
 	}
+	*phdr_p = phdr;
 	return (hdr);
 
 error: