From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id E78CFC433FE for ; Fri, 11 Nov 2022 20:13:24 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 5F3348E000D; Fri, 11 Nov 2022 15:13:24 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 5A2B38E0008; Fri, 11 Nov 2022 15:13:24 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 46A2D8E000D; Fri, 11 Nov 2022 15:13:24 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 340F38E0008 for ; Fri, 11 Nov 2022 15:13:24 -0500 (EST) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 00B271A0C5A for ; Fri, 11 Nov 2022 20:13:23 +0000 (UTC) X-FDA: 80122261128.19.0435181 Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) by imf11.hostedemail.com (Postfix) with ESMTP id ECB6F40009 for ; Fri, 11 Nov 2022 20:13:21 +0000 (UTC) Received: by mail-pg1-f179.google.com with SMTP id q71so5197379pgq.8 for ; Fri, 11 Nov 2022 12:13:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=CzfuirqUexa4OrUP6aM1ldAHfjduol2fhAGQPIMhaNg=; b=eiMN91hnPXZQzawWYNQtt2JbgJX4zONo3XXA2vHKrwUDAZM35OEnfRYlvN5dnWnHK3 pjLnnizKKu4ocjX9ODiE3DPWno1mHG1fttmdmWfyUh8rGHcRgmCdXnDpnak17egxCSpg lGr2Lz2VD1IMD9rcdGZMZuwgOUP314MaWeyXo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=CzfuirqUexa4OrUP6aM1ldAHfjduol2fhAGQPIMhaNg=; b=mI8vIwhEjf/I2oZp2wP2XbnSGmVItIsLizDY8WhxqrVCNuXq7GsKh8Yv4L/mx53P8k pF+FWzTDzGlrJ3wXl7PtIqUFCh1NFH7YitW1AfeOpuUADlpR03YsTy4X/wGryiEjiJme SbgwkSXwC7Tho+CMEYCO8h+v69AfojvEbIXmsRhhCNAKaCI8Pdgme3a8PNvhSBUHTyoR kobGQ4BCPyDs6O2fQjC3Xdtp3jYUgBLYgTRmtC77rlvoE9IlFemvzpBpQGmQzhO7p5i8 WMxh3X6M0QyAy1/W0HBMIxQqK5R0VVQpLzDReRPLSPOx3/ihlhUfqWL7syE6pdiF9H7E lKUg== X-Gm-Message-State: ANoB5pmeMrJuwiQ82Xz4SiSbQmh7M5NLy/tTX+uQ7DMPmcneuvj1riq+ D6HsgpjxAHrRFQxuTJAcCDAMlg== X-Google-Smtp-Source: AA0mqf7dRnhsd5f6m0AWWkQi2sWwEKci8En1oXPzGRb7yjL8j7GgD9if6YefVSBseGMxJjBYOXq8yQ== X-Received: by 2002:aa7:99c5:0:b0:562:3add:37e1 with SMTP id v5-20020aa799c5000000b005623add37e1mr4169347pfi.80.1668197600735; Fri, 11 Nov 2022 12:13:20 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id c188-20020a624ec5000000b0056be7ac5261sm1951559pfb.163.2022.11.11.12.13.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 11 Nov 2022 12:13:20 -0800 (PST) Date: Fri, 11 Nov 2022 12:13:19 -0800 From: Kees Cook To: Fangrui Song Cc: Pedro Falcato , Rich Felker , Alexander Viro , Eric Biederman , sam@gentoo.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: Re: [PATCH v2] binfmt_elf: Allow .bss in any interp PT_LOAD Message-ID: <202211111211.93ED8B4B@keescook> References: <20221111061315.gonna.703-kees@kernel.org> <20221111074234.xm5a6ota7ppdsto5@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221111074234.xm5a6ota7ppdsto5@google.com> ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1668197602; a=rsa-sha256; cv=none; b=btMBWdpqDwLynGWxomMYH0LB57ns5y6rsso6FVhwd/6LTl9mJwcx0TSehmGnWLO/kB/hK5 w+YQNDzg5K8Mv93/SIIghU11xS0iv3wvy1qX2TVMIOX1DVmeLgVBDgVY6ZdLIlHR5H+O64 CeAsQNs6TuaEaazxRI+MFF2zKQDDLIA= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=eiMN91hn; spf=pass (imf11.hostedemail.com: domain of keescook@chromium.org designates 209.85.215.179 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1668197602; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=CzfuirqUexa4OrUP6aM1ldAHfjduol2fhAGQPIMhaNg=; b=dV7iSyfSDvkHqTH2XKjjH9D2E4eGE2TYkpkqEt7c7dBvhQDNeLxKuRhiP8SdXNVSmluojr WiP4WMvC29QzPHaHlQ0cqT9e6zjEhVGiZkVfb7Ca0HstaDGQtGQiTG5mxW5zn+dzrGeWSu kVZvT8phIi5FxkCmzRlIDaa85mAHIqY= X-Stat-Signature: 3roqxctu9t3eua4krk4ptg79s684j6o1 X-Rspamd-Queue-Id: ECB6F40009 Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=eiMN91hn; spf=pass (imf11.hostedemail.com: domain of keescook@chromium.org designates 209.85.215.179 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org X-Rspam-User: X-Rspamd-Server: rspam12 X-HE-Tag: 1668197601-395194 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Nov 10, 2022 at 11:42:34PM -0800, Fangrui Song wrote: > (+ sam@gentoo.org from Pedro Falcato's patch) > > On 2022-11-10, Kees Cook wrote: > > Traditionally, only the final PT_LOAD for load_elf_interp() supported > > having p_memsz > p_filesz. Recently, lld's construction of musl's > > libc.so on PowerPC64 started having two PT_LOAD program headers with > > p_memsz > p_filesz. > > > > As the least invasive change possible, check for p_memsz > p_filesz for > > each PT_LOAD in load_elf_interp. > > > > Reported-by: Rich Felker > > Link: https://maskray.me/blog/2022-11-05-lld-musl-powerpc64 > > Cc: Pedro Falcato > > Cc: Fangrui Song > > Cc: Alexander Viro > > Cc: Eric Biederman > > Cc: linux-fsdevel@vger.kernel.org > > Cc: linux-mm@kvack.org > > Signed-off-by: Kees Cook > > --- > > v2: I realized we need to retain the final padding call. > > v1: https://lore.kernel.org/linux-hardening/20221111055747.never.202-kees@kernel.org/ > > --- > > fs/binfmt_elf.c | 18 ++++++++++++++---- > > 1 file changed, 14 insertions(+), 4 deletions(-) > > > > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c > > index 528e2ac8931f..0a24bbbef1d6 100644 > > --- a/fs/binfmt_elf.c > > +++ b/fs/binfmt_elf.c > > @@ -673,15 +673,25 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, > > last_bss = k; > > bss_prot = elf_prot; > > } > > + > > + /* > > + * Clear any p_memsz > p_filesz area up to the end > > + * of the page to wipe anything left over from the > > + * loaded file contents. > > + */ > > + if (last_bss > elf_bss && padzero(elf_bss)) > > Missing { > > But after fixing this, I get a musl ld.so error. > > > + error = -EFAULT; > > + goto out; > > + } > > } > > } > > > > /* > > - * Now fill out the bss section: first pad the last page from > > - * the file up to the page boundary, and zero it from elf_bss > > - * up to the end of the page. > > + * Finally, pad the last page from the file up to the page boundary, > > + * and zero it from elf_bss up to the end of the page, if this did > > + * not already happen with the last PT_LOAD. > > */ > > - if (padzero(elf_bss)) { > > + if (last_bss == elf_bss && padzero(elf_bss)) { > > error = -EFAULT; > > goto out; > > } > > -- > > 2.34.1 > > > > I added a new section to https://maskray.me/blog/2022-11-05-lld-musl-powerpc64 > Copying here: > > To test that the kernel ELF loader can handle more RW `PT_LOAD` program headers, we can create an executable with more RW `PT_LOAD` program headers with `p_filesz < p_memsz`. > We can place a read-only section after `.bss` followed by a `SHT_NOBITS` `SHF_ALLOC|SHF_WRITE` section. The read-only section will form a read-only `PT_LOAD` while the RW section will form a RW `PT_LOAD`. > > ```text > #--- a.c > #include > #include > > extern const char toc[]; > char nobits0[0] __attribute__((section(".nobits0"))); > char nobits1[0] __attribute__((section(".nobits1"))); > > int main(void) { > assert(toc[4096-1] == 0); > for (int i = 0; i < 1024; i++) > assert(nobits0[i] == 0); > nobits0[0] = nobits0[1024-1] = 1; > for (int i = 0; i < 4096; i++) > assert(nobits1[i] == 0); > nobits1[0] = nobits1[4096-1] = 1; > > puts("hello"); > } > > #--- toc.s > .section .toc,"aw",@nobits > .globl toc > toc: > .space 4096 > > .section .ro0,"a"; .byte 255 > .section .nobits0,"aw",@nobits; .space 1024 > .section .ro1,"a"; .byte 255 > .section .nobits1,"aw",@nobits; .space 4096 > > #--- a.lds > SECTIONS { .ro0 : {} .nobits0 : {} .ro1 : {} .nobits1 : {} } INSERT AFTER .bss; > ``` > > ```sh > split-file a.txt a > path/to/musl-gcc -Wl,--dynamic-linker=/lib/libc.so a/a.c a/a.lds -o toy > ``` > > split-file is a utility in llvm-project. Where is a.txt? Also, it'd be nice to have this without needing the musl-gcc. -- Kees Cook