kit

commit b21ac961e49c3c700f728a81b4abbad9eb48e50e
parent b4e0ba6840da790cb42f4ed63b684bbc3959ba55
Author: Ryan Sepassi <rsepassi@gmail.com>
Date:   Tue, 16 Jun 2026 15:13:51 -0700

link: wrap-safe scripted-layout MEMORY region-overflow checks

Bug 3: the region- and load-region-overflow panics in
link_layout_sections_scripted computed `r->origin + r->length` as a u64
with no overflow guard. For a canonical high-half kernel region
(ORIGIN=0xFFFFFFFF80000000, LENGTH=0x80000000) origin+length wraps to 0,
so a legal placement would falsely panic. Rewrite both checks to test
`end - r->origin > r->length` by subtraction (with an `end >= origin`
guard), preserving the existing exclusive end-fits semantics wrap-safely.

Diffstat:
M
src/link/link_layout.c
 | 
14
+++++++++++---

1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/src/link/link_layout.c b/src/link/link_layout.c
@@ -1447,7 +1447,13 @@ static void link_layout_sections_scripted(Linker* l, LinkImage* img,
     if (has_region) {
       const KitLinkRegion* r = &script->regions[region_idx];
       u64 end = dot;
-      if (sec_start_dot < r->origin || end > r->origin + r->length)
+      /* Bug 3: a section spanning [sec_start_dot, end) fits region r iff
+       * sec_start_dot >= origin and (end - origin) <= length. Compute the
+       * end-fits test by subtraction, never `origin + length`, which wraps to
+       * 0 for a canonical high-half region (e.g. ORIGIN=0xFFFFFFFF80000000,
+       * LENGTH=0x80000000) and would falsely flag a legal placement. */
+      if (sec_start_dot < r->origin || end < r->origin ||
+          end - r->origin > r->length)
         compiler_panic(
             l->c, SRCLOC_NONE,
             "linker script: section '%.*s' overflows MEMORY region '%.*s'",
@@ -1456,8 +1462,10 @@ static void link_layout_sections_scripted(Linker* l, LinkImage* img,
     }
     if (has_load_region && file_size_accum) {
       const KitLinkRegion* r = &script->regions[load_region_idx];
-      if (lma_start < r->origin ||
-          lma_start + file_size_accum > r->origin + r->length)
+      u64 lend = lma_start + file_size_accum;
+      /* Bug 3: same wrap-safe form for the load image [lma_start, lend). */
+      if (lma_start < r->origin || lend < r->origin ||
+          lend - r->origin > r->length)
         compiler_panic(
             l->c, SRCLOC_NONE,
             "linker script: load image for '%.*s' overflows MEMORY region "