Re: Someone using COMPAT_SVR4(_32) ?

On Wed, 13 Sep 2017, Jerome Ibanes wrote:

> Here is the ktrace/kdump under 5.2.3 sparc64 and 7.1 sparc64, both running
> GENERIC with the same sparc solaris 2.6 32-bits payload, the same binary is
> being used.
> 
> 5.2.3:
> [...]
>    463      1 k        NAMI  "/emul/svr4_32/usr/lib/libX11.so.4"
>    463      1 k        RET   open 4
>    463      1 k        CALL  fstat(4,0xffffd83c)
>    463      1 k        RET   fstat 0, 4294957116/0xffffd83c
>    463      1 k        CALL  mmap(0,0x2000,5,0x80000002,4,0)
>    463      1 k        RET   mmap 1074118656/0x4005c000, 8192/0x2000
>    463      1 k        CALL  mmap(0,0x88000,5,0x80000002,4,0)
>    463      1 k        RET   mmap 1074135040/0x40060000, 557056/0x88000
>    463      1 k        CALL  munmap(0x400d4000,0xe000)
>    463      1 k        RET   munmap 0, 57344/0xe000
>    463      1 k        CALL  mmap(0x400e2000,0x4d10,7,0x80000012,4,0x72000)
>    463      1 k        RET   mmap 1074667520/0x400e2000, 19728/0x4d10
>    463      1 k        CALL  close(4)
>    463      1 k        RET   close 0, 8192/0x2000
>    463      1 k        CALL  open(0x1002b9ac,0,0xffffd8c4)
> [...] emulation pursues with no issue.
> 
> 7.1:
> [...]
>   1119      1 k        NAMI  "/emul/svr4_32/usr/lib/libX11.so.4"
>   1119      1 k        RET   open 4
>   1119      1 k        CALL  fstat(0xffffd84c,0x80000002)
>   1119      1 k        RET   fstat 0
>   1119      1 k        CALL  mmap(0x2000,0x80000002,0,0x45f,2,0)
>   1119      1 k        RET   mmap 1074167808/0x40068000
>   1119      1 k        PSIG  SIGSEGV SIG_DFL: code=SEGV_MAPERR,
> addr=0x0, trap=48)
>   1119      1 k        NAMI  "test.core"
> 
> Please note that we observe exactly the same behavior under 6.0.6,
> 6.1.5, 7.0.2 and 7.1.
> The machine has 2GB of ram.

Oh, now it's obvious what's going on.

In the first case the kernel interprets the mmap() parameters as:

>    463      1 k        CALL  mmap(0,0x2000,5,0x80000002,4,0)

address = 0, size = 8KB, prot = 005, flags = 0x80000002, fd = 4, offset = 0

In the second case it thinks it's being passed in:

>   1119      1 k        CALL  mmap(0x2000,0x80000002,0,0x45f,2,0)

address = 0x2000, size = 2+GB, prot = 0, flags = 0x45f, fd = 2, offset = 0

The SCARG macro is supposed to automatically take the size of each 
argument and figure out how many 32-bit (in the case of svr4_32) words it 
maps to.  Looks like that's broken.

Eduardo