Fix memory-safety defects in ELF and virtio-blk

[jserv]

An audit of the first-party sources turned up three places where untrusted input reaches memory operations without being bounded. This fixes them, and adds a prototype sweep that fell out of the same warning pass.

The serious one is virtio-blk. The descriptor handler took the payload address and length straight from the guest's virtqueue and passed them to memcpy, checking only the sector. A guest can name a valid sector with an arbitrary length and run off the end of the disk mapping on write, or off the end of guest RAM on read. The sector check itself could be bypassed: capacity is deliberately left at zero when no disk image is attached, and the test was written as sector > capacity - 1, which wraps to UINT64_MAX and admits every sector onto a null disk pointer. Ranges are now validated in the same shape virtio-rng already used, the payload is bounded against the disk from the sector offset, and the status descriptor is checked before the status byte is written, since reporting an error through an unchecked pointer is not a way to report an error.

The ELF loader validated the magic, the class, and the machine type, and nothing else. raw_size was recorded and never used, so every header traversal indexed off the mapping with file-supplied offsets, including strcmp walking past the end of the buffer looking for a terminator. Validation now happens once where the file is accepted: both header tables and everything they claim to hold must lie in the file, string tables must end in a NUL, and the tables must be 4-aligned because their entries are cast to structs holding uint32_t. Sections are confirmed by type at each use as well, since looking a section up by name while validating it by type is how a section named .symtab but typed SHT_PROGBITS reaches a cast without passing the alignment check.

In mpool, the guard meant to ensure a pool holds at least one chunk added the header size rather than raising the pool to a full slot, so an undersized pool computed a chunk count of zero and the free-list loop bound wrapped to SIZE_MAX. No in-tree caller reaches it, but the function is public. Payload alignment is now enforced rather than assumed, and the duplicated free-list construction is folded into one helper; the two copies had already drifted.

Verified by building defconfig, mini, jit, system, and wasm, and by make check both plain and with ENABLE_UBSAN=1. Linux boots with a virtio-blk image attached and completes 512-byte and 4 KiB reads and writes. Injecting a hostile payload length at the point a malicious driver would place it segfaults the emulator before this series and halts the device while leaving the emulator alive after it. Fuzzing the ELF loader over 3000 structural mutations under ASan and UBSan went from 1396 crashes and no rejections to no crashes and 2702 rejections, with all ten prebuilt ELFs still loading; five hand-crafted type-confusion cases behave as intended. mpool has unit, randomized-churn, and TSan coverage. Each of the four commits builds on its own under both defconfig and system_defconfig.

Left out deliberately: 30 remaining -Wcast-align sites. They are container_of and offsetof patterns over malloc'd or page-aligned memory where the invariant holds but the compiler cannot see it, and the warning is not in the project's flag set. The two that were reachable with attacker-controlled misalignment, the ELF tables and the virtio descriptor read, are fixed here.

---

Summary by cubic

Fixes memory-safety defects where untrusted input reached memory operations without bounds checks: a malicious virtio-blk guest could crash the emulator, and a malformed ELF could drive out-of-bounds reads throughout the loader. Also fixes a sizing bug in mpool that could walk off the pool arena, and tightens empty parameter lists to (void).

Bug Fixes

• virtio-blk now bounds guest-supplied descriptor ranges and config-space offsets before memory is touched; disk geometry lives in host-owned fields so the config window can't rewrite it.
• The sector check no longer wraps when no disk is attached, zero-length disk images are rejected, and descriptor indices and header/status lengths are validated.
• The ELF loader validates both header tables, their contents, string-table NUL termination, and segment p_filesz vs p_memsz once at load; symbol-table lookups confirm section type.
• mpool raises undersized pools to at least one slot, aligns payloads, and builds freelists from the page-rounded arena.

Refactors

• Seventeen empty parameter lists now write (void); two file-local JIT helpers are static, and reset_rv_run_state() sits behind the Emscripten guard it is declared under.

^{Written for commit 0ef63a0. Summary will update on new commits.}

[jserv]

Benchmarks

Details

Benchmark suite	Current: 0ef63a0	Previous: 3ea8cae	Ratio
Dhrystone	2006.75 DMIPS	1513.333 DMIPS	0.75
CoreMark	1365.528 iterations/sec	1067.054 iterations/sec	0.78

This comment was automatically generated by workflow using github-action-benchmark.