https://sourceware.org/bugzilla/show_bug.cgi?id=34436
Bug ID: 34436
Summary: libdwfl: Mismatched flags for corresponding SHF_ALLOC
sections trigger assertion in
dwfl_offline_section_address
Product: elfutils
Version: unspecified
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: libdw
Assignee: unassigned at sourceware dot org
Reporter: karankurani3k at gmail dot com
CC: elfutils-devel at sourceware dot org, karankurani3k at
gmail dot com
Target Milestone: ---
Created attachment 16865
--> https://sourceware.org/bugzilla/attachment.cgi?id=16865&action=edit
Proposed fix and regression test
A malformed local ET_REL main object and its normally associated ET_REL
separate-debug file can cause libdwfl to abort in
dwfl_offline_section_address.
Tested commit:
fb5473ac7368bbbbc2ea9d86241bd6c882e3fcb5
The files use a real .gnu_debuglink section with a valid debug filename and
matching CRC. Their allocated-section order remains consistent, but the
corresponding allocated .text sections have different complete flag values:
main object .text: WA
separate debug object .text: AX
When libdwfl relocates DWARF from the separate debug file,
dwfl_offline_section_address maps allocated sections by order because section
indexes may differ between the main and separate-debug files. It then reaches:
assert (main_shdr->sh_flags == shdr->sh_flags);
The assertion terminates the process instead of rejecting the malformed
main/debug relationship with a clean callback or libdwfl error.
Public API path:
dwfl_report_offline
-> dwfl_report_end
-> dwfl_getmodules
-> dwfl_module_getdwarf
-> dwfl_standard_find_debuginfo
-> real .gnu_debuglink lookup with matching CRC
-> load_dw
-> __libdwfl_relocate
-> __libdwfl_relocate_value
-> dwfl_offline_section_address
Expected behavior:
libdwfl should reject mismatched flags for corresponding allocated sections
and propagate a clean callback/libdwfl failure without aborting the process.
Actual behavior:
The malformed pair aborts deterministically:
dwfl_offline_section_address:
Assertion `main_shdr->sh_flags == shdr->sh_flags' failed.
rc=134
Validation:
valid pair, baseline build: 3/3 rc=0
malformed pair, baseline build: 3/3 rc=134
valid pair, corrected build: 3/3 rc=0
malformed pair, corrected build: 3/3 rc=0 with clean failure
focused regression: 1 PASS, 0 FAIL
nearby libdwfl tests: 4 PASS, 0 FAIL
full make check: 256 PASS, 8 SKIP, 0 FAIL
ASan/UBSan focused regression: 1 PASS, 0 FAIL
Relationship to Bug 30980:
This is a remaining-assertion variant related to Bug 30980. Commit
a34c5faad861efdd26d1c52b4f8d9d4077e03131 converted the initial assertions
in dwfl_offline_section_address into graceful failures, but the later
section-flag equality assertion remained.
The reproducer passes those earlier checks and reaches the remaining assertion
through normal .gnu_debuglink discovery.
Proposed correction:
if (unlikely (main_shdr->sh_flags != shdr->sh_flags))
return -1;
This allows the failure to propagate through relocation and DWARF loading
without modifying the output address or aborting the process. Valid matching
main/debug pairs remain unchanged.
Impact:
Deterministic process abort / denial of service for consumers that process
malformed local ET_REL main and separate-debug files through the public
libdwfl offline DWARF path.
This report does not claim memory corruption or code execution.
Reporter:
Karan Kurani <[email protected]>
--
You are receiving this mail because:
You are on the CC list for the bug.
