This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-devel] Malformed image causing builder to crash

To: "Keir Fraser" <Keir.Fraser@xxxxxxxxxxxx>
Subject: [Xen-devel] Malformed image causing builder to crash
From: "Puthiyaparambil, Aravindh" <aravindh.puthiyaparambil@xxxxxxxxxx>
Date: Wed, 31 May 2006 13:53:42 -0400
Cc: xen-devel@xxxxxxxxxxxxxxxxxxx
Delivery-date: Wed, 31 May 2006 10:54:19 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
Thread-index: AcaE2yeVm1oz/BPfQ52C+tF6SZev+w==
Thread-topic: Malformed image causing builder to crash
An image with VIRT_START and ELF_PADDR_OFFSET equal to 0 and its linker
entry at 0xffffffff80000000 (Is this is an malformed image?) causes the
builder to crash in loadelfimage() [line 235] because parray is going
out of bounds. Output from the builder is show below. What seems to be
happening is that in setup_guest(), the variable v_end is becoming zero
after the "for ( nr_pt_pages = 2; ; nr_pt_pages++ )" loop. Also note
that the value of nr_pt_pages is very large. The reason is that
dsi->v_start is 0 which throws things off. But this is totally valid so
I am not sure what checks need to be introduced to stop this from
happening. Should the bounds check for the array be reintroduced?

Aravindh Puthiyaparambil 
Xen Development Team
Unisys, Tredyffrin PA

AP: kernstart: ffffffff80000000 kernend: ffffffff8001b4a0
dsi->v_kernentry: ffffffff80000000 dsi->v_start: 0, dsi->v_end:
AP: v_end: ffffffff8002f000 before loop
AP: After loop v_end: 0 nr_pages: 8192 nr_pt_pages: 523089
 Loaded kernel:    0xffffffff80000000->0xffffffff8001b4a0
 Phys-Mach map:    0xffffffff8001c000
 Start info:       0xffffffff8002c000
 Store page:       0xffffffff8002d000
 Console page:     0xffffffff8002e000
 Page tables:      0xffffffff8002f000
 Boot stack:       0xffffffffffb80000
 TOTAL:            (nil)->(nil)
 ENTRY ADDRESS:    0xffffffff80000000
AP: Before xc_map
Segmentation fault

Xen-devel mailing list

<Prev in Thread] Current Thread [Next in Thread>
  • [Xen-devel] Malformed image causing builder to crash, Puthiyaparambil, Aravindh <=