Re: [PATCH v2 2/2] hw/elf_ops: clear uninitialized segment space

[Laurent Vivier]

Le 15/04/2021 à 12:04, Philippe Mathieu-Daudé a écrit :
> From: Laurent Vivier <laurent@vivier.eu>
> 
> When the mem_size of the segment is bigger than the file_size,
> and if this space doesn't overlap another segment, it needs
> to be cleared.
> 
> This bug is very similar to the one we had for linux-user,
> 22d113b52f41 ("linux-user: Fix loading of BSS segments"),
> where .bss section is encoded as an extension of the the data
> one by setting the segment p_memsz > p_filesz.
> 
> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
> Message-Id: <20210414105838.205019-1-laurent@vivier.eu>
> [PMD: Use recently added address_space_set()]
> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> ---
>  include/hw/elf_ops.h | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/include/hw/elf_ops.h b/include/hw/elf_ops.h
> index 6ee458e7bc3..29f4c43e231 100644
> --- a/include/hw/elf_ops.h
> +++ b/include/hw/elf_ops.h
> @@ -562,6 +562,19 @@ static int glue(load_elf, SZ)(const char *name, int fd,
>                      if (res != MEMTX_OK) {
>                          goto fail;
>                      }
> +                    /*
> +                     * We need to zero'ify the space that is not copied
> +                     * from file
> +                     */
> +                    if (file_size < mem_size) {
> +                        res = address_space_set(as ? as : 
> &address_space_memory,
> +                                                addr + file_size, 0,
> +                                                mem_size - file_size,
> +                                                MEMTXATTRS_UNSPECIFIED);
> +                        if (res != MEMTX_OK) {
> +                            goto fail;
> +                        }
> +                    }
>                  }
>              }
>  
> 

It seems we need also the same kind of operation with the other branch of the if
(rom_add_elf_program()), but I'm not sure where to do it:

diff --git a/hw/core/loader.c b/hw/core/loader.c
index d3e5f3b423f6..8146fdcbb7a0 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -1146,9 +1146,13 @@ static void rom_reset(void *unused)
         if (rom->mr) {
             void *host = memory_region_get_ram_ptr(rom->mr);
             memcpy(host, rom->data, rom->datasize);
+            memset(host + rom->datasize, 0, rom->romsize - rom->datasize);
         } else {
             address_space_write_rom(rom->as, rom->addr, MEMTXATTRS_UNSPECIFIED,
                                     rom->data, rom->datasize);
+            address_space_set(rom->as, rom->addr + rom->datasize, 0,
+                              rom->romsize - rom->datasize,
+                              MEMTXATTRS_UNSPECIFIED);
         }
         if (rom->isrom) {
             /* rom needs to be written only once */

Thanks,
Laurent