Re: Bash's malloc does not work within qemu-user when compiled with PIE enabled

[Eduardo A . Bustamante López]

> On 2/14/18 3:38 AM, Raphael Hertzog wrote:
[...]
> > Isn't it possible that sbrk() returns that pointer to you and you treat
> > it as being an error instead of a valid address?

The problem is in QEMU:

    dualbus@ubuntu:~$ cat sbrk.c 
    #include <stdio.h>
    #include <unistd.h>
    int main() {
        fprintf(stderr, "%ld\n", (long)sbrk(0));
        fprintf(stderr, "%ld\n", (long)sbrk(4096));
        return 0;
    }

    dualbus@ubuntu:~$ gcc -o sbrk sbrk.c

    dualbus@ubuntu:~$ ./sbrk 
    94870340603904
    94870340603904

    dualbus@ubuntu:~$ qemu-x86_64 ./sbrk 
    warning: TCG doesn't support requested feature: CPUID.01H:ECX.vmx [bit 5]
    274880012288
    -1

    dualbus@ubuntu:~$ gcc -o sbrk sbrk.c -no-pie

    dualbus@ubuntu:~$ qemu-x86_64 ./sbrk 
    warning: TCG doesn't support requested feature: CPUID.01H:ECX.vmx [bit 5]
    6299648
    6299648


i.e. the QEMU emulated `brk' system call returns -1 (ENOMEM) to a simple 4096
byte request. This causes bash's `pagealign()' function to fail, and thus the
error propagates into internal_malloc, and all the way up to xmalloc. See:

  
http://git.savannah.gnu.org/cgit/bash.git/tree/lib/malloc/malloc.c?h=devel#n765


I suspect the problem might be in the implementation of the `brk' system call in
QEMU, i.e. do_brk:

  https://github.com/qemu/qemu/blob/master/linux-user/syscall.c#L1091