From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 921CFC433FE for ; Fri, 11 Nov 2022 03:38:50 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 92A406B0071; Thu, 10 Nov 2022 22:38:49 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 8DA656B0072; Thu, 10 Nov 2022 22:38:49 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7A21C6B0074; Thu, 10 Nov 2022 22:38:49 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 6A09E6B0071 for ; Thu, 10 Nov 2022 22:38:49 -0500 (EST) Received: from smtpin10.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 299FE14042A for ; Fri, 11 Nov 2022 03:38:49 +0000 (UTC) X-FDA: 80119754778.10.5488965 Received: from mail-pf1-f180.google.com (mail-pf1-f180.google.com [209.85.210.180]) by imf13.hostedemail.com (Postfix) with ESMTP id C417A20003 for ; Fri, 11 Nov 2022 03:38:47 +0000 (UTC) Received: by mail-pf1-f180.google.com with SMTP id k15so3856419pfg.2 for ; Thu, 10 Nov 2022 19:38:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=yBNei5h4u7yfXoS80paK9OSVEakmAYHRYKZMGMpdlsE=; b=YTJOtdlboLe7NHWdyua3Xha6po+V4K7iL7s/tUMK0qzBMsZSWqzdbfM6UkSy31v3oi iqWjvWDNzPimsRrpbymbpWN7qOiLBqnxbFgmvIOQHobtBLMu1pXIPq75m2WgmaBSIxmz QneCiBIS//+FpQ5H7QbFR3ZrdCsM2sfI+kuEI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=yBNei5h4u7yfXoS80paK9OSVEakmAYHRYKZMGMpdlsE=; b=bDZ7KY3SV7ScnutnNlK1lXGA7cVkzK2yBsVYoEg1ihyMfLCqpsf/golNm2KkD1DYRq kQ5dEMQBIHRTlsx/qvsB78TGWwxTXxC3SSFCRc3XiSW64pNk3dhYUj2zsGIqjCCGQImY JUcXdWtZ8IeITtoetuAUTxnmauQE1RBIb1xiTNVnMk0NpP0L2GHxbuXbkxqlCO1lJ0QO ztzNuGMO/cZMV0CalQd8pWExPOrY5sv8u04axHIdrhr8aiqwCls7CWY8BA9ufYEJS0I+ 68z0qohNuLpGekJ7S8sPpsdDJL3TZr14TAqUfmm/8ytWnBNNCvt4oLXPJO5sWk1Qv+Wo D2RA== X-Gm-Message-State: ANoB5pnG2VxO1VGEytZK0LeiPm2qzuEvu7b87Vj1eezBdAG/ktcty+yt oNxcIfrssuJuxAinlbY2ZDc+1w== X-Google-Smtp-Source: AA0mqf4j95CO8KetxfmT+m9ed9cGkWk+oGq+gFsPdc3TkiKPWRYtI9pGv5K9FL4RgZfMlQ5/O9H+Sg== X-Received: by 2002:aa7:9839:0:b0:56b:d363:a31b with SMTP id q25-20020aa79839000000b0056bd363a31bmr598232pfl.78.1668137926642; Thu, 10 Nov 2022 19:38:46 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id t7-20020a635347000000b0046fe244ed6esm379447pgl.23.2022.11.10.19.38.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 10 Nov 2022 19:38:45 -0800 (PST) Date: Thu, 10 Nov 2022 19:38:44 -0800 From: Kees Cook To: Pedro Falcato Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, dalias@libc.org, ebiederm@xmission.com, sam@gentoo.org, viro@zeniv.linux.org.uk Subject: Re: [PATCH v3] fs/binfmt_elf: Fix memsz > filesz handling Message-ID: <202211101934.22CACD615@keescook> References: <20221108110715.227062-1-pedro.falcato@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221108110715.227062-1-pedro.falcato@gmail.com> ARC-Authentication-Results: i=1; imf13.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=YTJOtdlb; spf=pass (imf13.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.180 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1668137927; a=rsa-sha256; cv=none; b=e4f8Vzkka1YPwESDgCcIfkaXrrRmE7t4SnGNVgygrwD2zgyG+Gv3Gqx/HKg/EzPi265vj5 p0tPKmdFGIrmHp969jyhF+DU0xm7LCetatFicyDMNcb4Ku6dXTYJux/uMjK8AKAT12q3sE E0aO5ba2kfgF1BVFB9oju6y+/WaUJts= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1668137927; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=yBNei5h4u7yfXoS80paK9OSVEakmAYHRYKZMGMpdlsE=; b=yWHYfua/CtOI8lmoAAOKSSDM4/xaSd4NkdrpJRBsDl5tkoEMbpr+iHQ+zmilSAJrV+yhKq ecHe7ud4OTJGez7flW5DTNQlfOPI6XGgPq0Qvfy22QFK+7kLvkoZXGyenSc/JJflwTJ+MQ FF9puRBlWIIZ8PQ24z3x6pj3GFV8JT8= X-Stat-Signature: rgcj9i13kjg8gcop33jikd7xkk3abkjg X-Rspamd-Queue-Id: C417A20003 X-Rspam-User: Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=YTJOtdlb; spf=pass (imf13.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.180 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org X-Rspamd-Server: rspam11 X-HE-Tag: 1668137927-155617 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Nov 08, 2022 at 11:07:15AM +0000, Pedro Falcato wrote: > [...] > + * This tail logic is skippable if we're the last phdr, as > + * nothing can map an address >= our p_vaddr, since ELF phdr > + * PT_LOAD segments are required to be sorted in an increasing > + * order. I'm still looking through the patch, but I do want to call this bit out as a problem. The kernel cannot, unfortunately, make this assumption. See: https://lore.kernel.org/linux-fsdevel/YfOooXQ2ScpZLhmD@fractal.localdomain/ "It turns out that almost all native Linux games published by the Virtual Programming company have this kind of weird PT_LOAD ordering including the famous Bioshock Infinite ... Someone should probably ask Virtual Programming, what kind of tooling they use to create such convoluted ELF binaries." So, even though it's in violation of the spec, these binaries exist in the real world, and we cannot break them. :( -- Kees Cook