 @@ -1,14 +1,14 @@
-/*	$NetBSD: exec_elf.c,v 1.59 2014/02/19 15:23:20 maxv Exp $	*/
+/*	$NetBSD: exec_elf.c,v 1.60 2014/02/21 07:47:02 maxv Exp $	*/
 /*-
  * Copyright (c) 1994, 2000, 2005 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Christos Zoulas.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -47,27 +47,27 @@
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(1, "$NetBSD: exec_elf.c,v 1.59 2014/02/19 15:23:20 maxv Exp $");
+__KERNEL_RCSID(1, "$NetBSD: exec_elf.c,v 1.60 2014/02/21 07:47:02 maxv Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_pax.h"
 #endif /* _KERNEL_OPT */
 #include <sys/param.h>
 #include <sys/proc.h>
 #include <sys/kmem.h>
 #include <sys/namei.h>
 #include <sys/vnode.h>
 #include <sys/exec.h>
 #include <sys/exec_elf.h>
 #include <sys/syscall.h>
 @@ -863,27 +863,27 @@ bad:
 	exec_free_emul_arg(epp);
 	kmem_free(ph, phsize);
 	kill_vmcmds(&epp->ep_vmcmds);
 	return error;
+}
 int
 netbsd_elf_signature(struct lwp *l, struct exec_package *epp,
     Elf_Ehdr *eh)
+{
 	size_t i;
 	Elf_Shdr *sh;
 	Elf_Nhdr *np;
-	size_t shsize;
+	size_t shsize, nsize;
 	int error;
 	int isnetbsd = 0;
 	char *ndata;
 	epp->ep_pax_flags = 0;
 	if (eh->e_shnum > MAXSHNUM || eh->e_shnum == 0)
 		return ENOEXEC;
 	shsize = eh->e_shnum * sizeof(Elf_Shdr);
 	sh = kmem_alloc(shsize, KM_SLEEP);
 	error = exec_read_from(l, epp->ep_vp, eh->e_shoff, sh, shsize);
 	if (error)
 		goto out;
 @@ -892,42 +892,54 @@ netbsd_elf_signature(struct lwp *l, stru
 	for (i = 0; i < eh->e_shnum; i++) {
 		Elf_Shdr *shp = &sh[i];
 		if (shp->sh_type != SHT_NOTE ||
 		    shp->sh_size > MAXNOTESIZE ||
 		    shp->sh_size < sizeof(Elf_Nhdr) + ELF_NOTE_NETBSD_NAMESZ)
 			continue;
 		error = exec_read_from(l, epp->ep_vp, shp->sh_offset, np,
 		    shp->sh_size);
 		if (error)
 			continue;
 		/* Point to the note, skip the header */
 		ndata = (char *)(np + 1);
 		unsigned int maxlen = (unsigned int)(shp->sh_size -
-		    ((char *)ndata - (char *)np));
+		/*
-		if (maxlen < np->n_namesz)
+		 * Padding is present if necessary to ensure 4-byte alignment.
 		 * The actual section size is therefore:
 		 *    header size + 4-byte aligned name + 4-byte aligned desc
 		 * Ensure this size is consistent with what is indicated
 		 * in sh_size. The first check avoids integer overflows.
 		 */
 		if (np->n_namesz > shp->sh_size || np->n_descsz > shp->sh_size)
 			goto bad;
 		nsize = sizeof(*np) + roundup(np->n_namesz, 4) +
 		    roundup(np->n_descsz, 4);
 		if (nsize != shp->sh_size)
 			goto bad;
 		switch (np->n_type) {
 		case ELF_NOTE_TYPE_NETBSD_TAG:
 			/*
 			 * It is us
 			 */
 			if (np->n_namesz == ELF_NOTE_NETBSD_NAMESZ &&
 			    np->n_descsz == ELF_NOTE_NETBSD_DESCSZ &&
 			    memcmp(ndata, ELF_NOTE_NETBSD_NAME,
 			    ELF_NOTE_NETBSD_NAMESZ) == 0) {
 				memcpy(&epp->ep_osversion,
-				    ndata + ELF_NOTE_NETBSD_NAMESZ + 1,
+				    ndata + roundup(ELF_NOTE_NETBSD_NAMESZ, 4),
 				    ELF_NOTE_NETBSD_DESCSZ);
 				isnetbsd = 1;
 				break;
+			}
 			/*
 			 * Ignore SuSE tags
 			 */
 			if (np->n_namesz == ELF_NOTE_SUSE_NAMESZ &&
 			    memcmp(ndata, ELF_NOTE_SUSE_NAME,
 			    ELF_NOTE_SUSE_NAMESZ) == 0)
 				break;
 			/*
 			 * Dunno, warn for diagnostic
 @@ -939,37 +951,38 @@ netbsd_elf_signature(struct lwp *l, stru
 			    np->n_descsz != ELF_NOTE_PAX_DESCSZ ||
 			    memcmp(ndata, ELF_NOTE_PAX_NAME,
 			    ELF_NOTE_PAX_NAMESZ)) {
 bad:
 #ifdef DIAGNOSTIC
+			{
 				/*
 				 * Ignore GNU tags
 				 */
 				if (np->n_namesz == ELF_NOTE_GNU_NAMESZ &&
 				    memcmp(ndata, ELF_NOTE_GNU_NAME,
 				    ELF_NOTE_GNU_NAMESZ) == 0)
 				    break;
 				int ns = MIN(np->n_namesz, maxlen);
 				int ns = MIN(np->n_namesz, shp->sh_size - sizeof(*np));
 				printf("%s: Unknown elf note type %d: "
 				    "[namesz=%d, descsz=%d name=%*.*s]\n",
 				    epp->ep_kname, np->n_type, np->n_namesz,
 				    np->n_descsz, ns, ns, ndata);
+			}
 #endif
 				continue;
+			}
 			(void)memcpy(&epp->ep_pax_flags,
-			    ndata + ELF_NOTE_PAX_NAMESZ,
+			    ndata + roundup(ELF_NOTE_PAX_NAMESZ, 4),
 			    sizeof(epp->ep_pax_flags));
 			break;
 		case ELF_NOTE_TYPE_MARCH_TAG:
 			/*
 			 * Copy the machine arch into the package.
 			 */
 			if (np->n_namesz == ELF_NOTE_MARCH_NAMESZ
 			    && memcmp(ndata, ELF_NOTE_MARCH_NAME,
 				    ELF_NOTE_MARCH_NAMESZ) == 0) {
 				strlcpy(epp->ep_machine_arch,
 				    ndata + roundup(ELF_NOTE_MARCH_NAMESZ, 4),
 				    sizeof(epp->ep_machine_arch));