Re: [PULL 5/5] linux-user: Fix qemu-arm to run static armhf binaries

[Helge Deller]

On 7/21/23 17:14, Michael Tokarev wrote:
> 19.07.2023 18:52, Helge Deller wrote:
> > qemu-user crashes immediately when running static binaries on the armhf
> > architecture. The problem is the memory layout where the executable is
> > loaded before the interpreter library, in which case the reserved brk
> > region clashes with the interpreter code and is released before qemu
> > tries to start the program.
> >
> > At load time qemu calculates a brk value for interpreter and executable
> > each.  The fix is to choose the higher one of both.
> >
> > Signed-off-by: Helge Deller <deller@gmx.de>
> > Cc: Andreas Schwab <schwab@suse.de>
> > Cc: qemu-stable@nongnu.org
> > Reported-by:  Venkata.Pyla@toshiba-tsip.com
> > Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040981
> > ---
> >   linux-user/elfload.c | 7 +++++++
> >   1 file changed, 7 insertions(+)
> >
> > diff --git a/linux-user/elfload.c b/linux-user/elfload.c
> > index a26200d9f3..94951630b1 100644
> > --- a/linux-user/elfload.c
> > +++ b/linux-user/elfload.c
> > @@ -3615,6 +3615,13 @@ int load_elf_binary(struct linux_binprm *bprm, struct 
> > image_info *info)
> >
> >       if (elf_interpreter) {
> >           load_elf_interp(elf_interpreter, &interp_info, bprm->buf);
> > +        /*
> > +         * adjust brk address if the interpreter was loaded above the main
> > +         * executable, e.g. happens with static binaries on armhf
> > +         */
> > +        if (interp_info.brk > info->brk) {
> > +            info->brk = interp_info.brk;
> > +        }
>
> So, this is kinda amusing.
> This broke arm64, ppc64el and s390x:
>
> arm64$ ./qemu-aarch64 /bin/sh -c '/bin/ls -dCFl *[t]* >/dev/null'
> qemu: uncaught target signal 11 (Segmentation fault) - core dumped
> Segmentation fault
>
> (it was just a quick test from debian qemu-user package).
>
> Reverting this patch makes it work again..
>
> *Sigh*.

Argh, that's really unfortunate.
I just tested myself.
Running static busybox binary did work for me:
# ./qemu-aarch64 busybox
BusyBox v1.30.1 (Debian 1:1.30.1-6+b3) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
....

I'd like to test dynamic binary as well, but I'm currently failing
to set up an aarch64 chroot here.
Sadly I won't have time to do any further testing until sunday evening
(travelling over the weekend).
Maybe someone else can try? I leave it up to Peter if he wants to revert
that patch right now, or if it can wait a few days until I'm back?

Helge