patchelf still corrupting binaries on mips64el-linux-gnuabin32 #364
Description
Even with the fixes in #82 and #180, it appears that patchelf --set-interpreter still corrupts binaries on MIPS.
The following is on an Octeon. Note that the argument passed to --set-interpeter has enough leading slashes to make it exactly the same length as the interpreter being replaced, so file offsets shifting around isn't the issue here.
I would have expected that only those bytes in the binary would change, but as the diff below shows, patchelf is changing lots of other stuff in the binary. In any case (see end of report) the resulting binary segfaults, whereas the original did not.
$ /tmp/patchelf/src/patchelf --version
patchelf 0.14.3
$ git -C /tmp/patchelf rev-parse HEAD
bdb09e90f75406068b061a69a3bde3878e5287fa
$ cp bash bash+
$ /tmp/patchelf/src/patchelf --set-interpreter /////////////////////////////////////////////////////////////////////////////tmp/q/lib/ld.so.1 bash+
$ readelf -a bash > bash.readelf
$ readelf -a bash+ > bash.readelf+
$ colordiff -u bash.readelf bash.readelf+
--- bash.readelf 2022-01-21 22:14:36.951398176 -0800
+++ bash.readelf+ 2022-01-21 22:14:39.481427205 -0800
@@ -22,7 +22,7 @@
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
- [ 1] .interp PROGBITS 10000194 000194 00005f 00 A 0 0 1
+ [ 1] .interp PROGBITS 10000194 000194 00005f 00 A 0 0 4
[ 2] .note.ABI-tag NOTE 100001f4 0001f4 000020 00 A 0 0 4
[ 3] .MIPS.abiflags MIPS_ABIFLAGS 10000218 000218 000018 18 A 0 0 8
[ 4] .reginfo MIPS_REGINFO 10000230 000230 000018 18 A 0 0 8
@@ -62,31 +62,31 @@
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x10000034 0x10000034 0x00160 0x00160 R 0x4
+ GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10
+ NULL 0x000000 0x00000000 0x00000000 0x00000 0x00000 0x4
+ LOAD 0x000000 0x10000000 0x10000000 0xd9194 0xd9194 R E 0x10000
INTERP 0x000194 0x10000194 0x10000194 0x0005f 0x0005f R 0x1
- [Requesting program interpreter: /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-glibc-mips64el-linux-gnuabin32-2.33-59/lib/ld.so.1]
+ [Requesting program interpreter: /////////////////////////////////////////////////////////////////////////////tmp/q/lib/ld.so.1]
+ NOTE 0x0001f4 0x100001f4 0x100001f4 0x00020 0x00020 R 0x4
ABIFLAGS 0x000218 0x10000218 0x10000218 0x00018 0x00018 R 0x8
REGINFO 0x000230 0x10000230 0x10000230 0x00018 0x00018 R 0x8
- LOAD 0x000000 0x10000000 0x10000000 0xd9194 0xd9194 R E 0x10000
- LOAD 0x0d95e0 0x100e95e0 0x100e95e0 0x03a48 0x0d530 RW 0x10000
DYNAMIC 0x000248 0x10000248 0x10000248 0x00108 0x00108 R 0x4
- NOTE 0x0001f4 0x100001f4 0x100001f4 0x00020 0x00020 R 0x4
- GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10
+ LOAD 0x0d95e0 0x100e95e0 0x100e95e0 0x03a48 0x0d530 RW 0x10000
GNU_RELRO 0x0d95e0 0x100e95e0 0x100e95e0 0x00a20 0x00a20 R 0x1
- NULL 0x000000 0x00000000 0x00000000 0x00000 0x00000 0x4
Section to Segment mapping:
Segment Sections...
00
- 01 .interp
- 02 .MIPS.abiflags
- 03 .reginfo
- 04 .interp .note.ABI-tag .MIPS.abiflags .reginfo .dynamic .hash .dynsym .dynstr .gnu.version .gnu.version_r .init .text .MIPS.stubs .fini .rodata .eh_frame
- 05 .ctors .dtors .data.rel.ro .data .rld_map .got .sdata .sbss .bss
- 06 .dynamic
- 07 .note.ABI-tag
- 08
- 09 .ctors .dtors .data.rel.ro
- 10
+ 01
+ 02
+ 03 .interp .note.ABI-tag .MIPS.abiflags .reginfo .dynamic .hash .dynsym .dynstr .gnu.version .gnu.version_r .init .text .MIPS.stubs .fini .rodata .eh_frame
+ 04 .interp
+ 05 .note.ABI-tag
+ 06 .MIPS.abiflags
+ 07 .reginfo
+ 08 .dynamic
+ 09 .ctors .dtors .data.rel.ro .data .rld_map .got .sdata .sbss .bss
+ 10 .ctors .dtors .data.rel.ro
Dynamic section at offset 0x248 contains 28 entries:
Tag Type Name/Value
@@ -102,7 +102,7 @@
0x0000000a (STRSZ) 26578 (bytes)
0x0000000b (SYMENT) 16 (bytes)
0x70000016 (MIPS_RLD_MAP) 0x100eb840
- 0x70000035 (MIPS_RLD_MAP_REL) 0xeb598
+ 0x70000035 (MIPS_RLD_MAP_REL) 0xeb658
0x00000015 (DEBUG) 0x0
0x00000003 (PLTGOT) 0x100eb850
0x70000001 (MIPS_RLD_VERSION) 1
Unfortunately the result is corrupt:
$ /////////////////////////////////////////////////////////////////////////////tmp/q/lib/ld.so.1 ./bash+
Segmentation fault
even though the original works correctly:
$ /////////////////////////////////////////////////////////////////////////////tmp/q/lib/ld.so.1 ./bash
\[\]I have no name!@brant:/tmp/q/bin$ exit