sea: keep ELF segments on separate pages in --build-sea output

When node itself is not position independent (the official Linux
binaries, and any build with a toolchain that does not default to PIE),
LIEF made room for the extra program header by moving the header table
into the largest gap between two PT_LOAD segments and extending the
earlier segment across that gap. Whenever the gap it picked was the one
between the read-only data and the read-write segment, whose boundary
is not page aligned, the extended segment ended inside the first page
of the next one. Linux 4.17 to 5.3, and RHEL 8's 4.18 kernel, map an
executable's segments with MAP_FIXED_NOREPLACE and refuse the second
mapping, so the single executable was killed with SIGSEGV before it ran
a single instruction ('elf segment at ... requested but the memory is
mapped already' in the kernel log). Which gap is largest depends on
section sizes, so roughly one build in three produced such binaries.

Ask LIEF to place the table after .bss for non-PIE executables instead,
which leaves every existing segment as the linker laid it out; the
output grows by the size of .bss. A test checks that no two PT_LOAD
segments of a --build-sea executable share a page.

Signed-off-by: Shelley Vohr <shelley.vohr@gmail.com>
PR-URL: #65564
Refs: nodejs/build#4433
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: codebytere

src/node_sea_bin.cc

@@ -126,6 +126,16 @@ InjectOutput InjectIntoELF(const std::vector<uint8_t>& executable,
             {},
             SPrintF("Failed to create new ELF note %s", note_name)};
   }
+  // Left to itself LIEF moves a non-PIE executable's program headers into
+  // the largest gap between two PT_LOADs and extends the earlier one over it,
+  // which can leave that segment sharing a page with the next; kernels that
+  // map segments with MAP_FIXED_NOREPLACE (Linux < 5.4, RHEL 8) then refuse
+  // to run the file. After .bss every segment keeps its own pages.
+  if (binary->header().file_type() == LIEF::ELF::Header::FILE_TYPE::EXEC &&
+      binary->relocate_phdr_table(LIEF::ELF::Binary::PHDR_RELOC::BSS_END) ==
+          0) {
+    return {InjectResult::kError, {}, "Failed to relocate ELF program headers"};
+  }
   binary->add(*new_note);
 
   LIEF::ELF::Builder::config_t cfg;

test/sea/test-build-sea-elf-segments.js

@@ -0,0 +1,37 @@
+'use strict';
+// This tests that --build-sea emits an ELF whose PT_LOAD segments never share
+// a page, since kernels that map them with MAP_FIXED_NOREPLACE (Linux < 5.4,
+// RHEL 8) refuse to execute such a file.
+
+const common = require('../common');
+if (process.platform !== 'linux')
+  common.skip('ELF-specific');
+
+const { buildSEA, skipIfBuildSEAIsNotSupported } = require('../common/sea');
+skipIfBuildSEAIsNotSupported();
+
+const assert = require('assert');
+const { readFileSync } = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const elf = readFileSync(buildSEA(fixtures.path('sea', 'basic')));
+assert.strictEqual(elf[4], 2);  // ELFCLASS64
+const phoff = Number(elf.readBigUInt64LE(0x20));
+const phentsize = elf.readUInt16LE(0x36);
+const phnum = elf.readUInt16LE(0x38);
+const loads = [];
+for (let i = 0; i < phnum; i++) {
+  const at = phoff + i * phentsize;
+  if (elf.readUInt32LE(at) !== 1) continue;  // PT_LOAD
+  const vaddr = elf.readBigUInt64LE(at + 0x10);
+  const memsz = elf.readBigUInt64LE(at + 0x28);
+  if (memsz > 0n) loads.push({ first: vaddr >> 12n, last: (vaddr + memsz - 1n) >> 12n });
+}
+loads.sort((a, b) => (a.first < b.first ? -1 : 1));
+for (let i = 1; i < loads.length; i++) {
+  assert(loads[i].first > loads[i - 1].last,
+         `PT_LOAD ${i} starts on page 0x${loads[i].first.toString(16)}, ` +
+         `which PT_LOAD ${i - 1} already covers`);
+}