From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC6D9EB64DD for ; Tue, 11 Jul 2023 16:11:14 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4DE316B0072; Tue, 11 Jul 2023 12:11:14 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 48EF56B0074; Tue, 11 Jul 2023 12:11:14 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 331EE6B0075; Tue, 11 Jul 2023 12:11:14 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 22DAE6B0072 for ; Tue, 11 Jul 2023 12:11:14 -0400 (EDT) Received: from smtpin27.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 4077040316 for ; Tue, 11 Jul 2023 16:11:13 +0000 (UTC) X-FDA: 80999820426.27.E7A4B56 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) by imf29.hostedemail.com (Postfix) with ESMTP id 2F750120020 for ; Tue, 11 Jul 2023 16:11:10 +0000 (UTC) Authentication-Results: imf29.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=lAX+nmUn; spf=pass (imf29.hostedemail.com: domain of keescook@chromium.org designates 209.85.214.169 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1689091871; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=14BF34CA+deUxHLUvuKK0NdUXrmzEpT2HQriQO+aNSc=; b=FCgs9uAVZY6rKiukLiVDd7N03yyhniwBD1/B4KtFW3f41dQYqp4+atrmrAdv+s4fW/sfCJ fEsFCoEhn8HGC2CvBuTlZjHkj9kZr5QmWi2ar+Wm7quYMwmiqwVFrkE/cWxVHe5oxtx9SF IScS1c63aPszx/ZyGTaCp3AFaISIGEQ= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1689091871; a=rsa-sha256; cv=none; b=RwZWulFIve5CEV3LX1ijASuAuFMggKg9k/tdsXGVwGZCE1qAfk3L0xcFRuO83G2h7E10JO B0M3sGaxdf4Ek9YeylR5Pp1LQ4LMTV6pbf/dpQmbXBcTuyildm03K86/V58t4Ii8tq0FJm 03DEPkXNapQHAhjYWc5xKzqFTsuAYzo= ARC-Authentication-Results: i=1; imf29.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=lAX+nmUn; spf=pass (imf29.hostedemail.com: domain of keescook@chromium.org designates 209.85.214.169 as permitted sender) smtp.mailfrom=keescook@chromium.org; dmarc=pass (policy=none) header.from=chromium.org Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-1b8bbcfd89aso29943035ad.1 for ; Tue, 11 Jul 2023 09:11:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1689091870; x=1691683870; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=14BF34CA+deUxHLUvuKK0NdUXrmzEpT2HQriQO+aNSc=; b=lAX+nmUnvQh8Wr4sSat33joYcFucraRvBlLjDezD4gl2CuEiTvYwK1rISc2zz7VGl3 4Z9xm4yMTWpiCWj83z0n3GITD7+A8laRk8aL0Ab2ADl3io+anea7vTXZTAG1PvdDyofW w0Vyjl/9h85bclpewVFAtdHzjAJ7OSyEq+mpc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689091870; x=1691683870; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=14BF34CA+deUxHLUvuKK0NdUXrmzEpT2HQriQO+aNSc=; b=eFC2mllnws0BIBg9m+pBtzz0dPaU9tJY0fN3IcWzZYloXNx6FGXFckj/vUBInbUJ5L BWAPHCQhvOeVDbvLPgeietH92n18NnqXLK3QIU/JYbTkR5mSPy66sLay0CSNrpUmc+bR 41YW+lu25Jqo/jILhPgclm2tBn5BneAmlqoO4SdDBbjMYnao89YpVGbvZCjMpG7b/5yx BCEXiK/U71WexIJzaw6MnBSnZwHn/zvi9w96dZSLSXGpJhs/v+zVru2vYfSG8+ynxj+T A8hH1eSlgoi3raSPQIplAEaq/FQ65puDkZHiOzGhQ4uZTIIUMMO8l3AQixVMFvC0NKbB M5Yw== X-Gm-Message-State: ABy/qLawG/uMVnOasIL+uLr1ej5UFquPPi5Rcb2ULO3iDIG2/6SRdAf3 EsyOrEvyFWAjmshhcpfDe9vpUg== X-Google-Smtp-Source: APBJJlGtLe6pwcli4y1GKQQMwNq1rjUHkyjEzCkkqTqxZcuk3wugA2wX5iXhBtkX+30AaZAOZXOf2g== X-Received: by 2002:a17:902:e548:b0:1b9:e1d5:c826 with SMTP id n8-20020a170902e54800b001b9e1d5c826mr4519362plf.16.1689091869978; Tue, 11 Jul 2023 09:11:09 -0700 (PDT) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id c18-20020a170902c1d200b001b872695c1csm2098419plc.256.2023.07.11.09.11.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jul 2023 09:11:08 -0700 (PDT) Date: Tue, 11 Jul 2023 09:11:08 -0700 From: Kees Cook To: Greg Ungerer Cc: linux-arm@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, viro@zeniv.linux.org.uk, ebiederm@xmission.com, brauner@kernel.org Subject: Re: [PATCH] fs: binfmt_elf_efpic: fix personality for fdpic ELF Message-ID: <202307110901.7E9A0D0AE5@keescook> References: <20230711133955.483393-1-gerg@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230711133955.483393-1-gerg@kernel.org> X-Rspamd-Queue-Id: 2F750120020 X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: 93sbmeedhwye7sxsacegqc3ecdur73ob X-HE-Tag: 1689091870-762432 X-HE-Meta: U2FsdGVkX19f1XMepKNG8UldR5DugXncE2ZdZkckqq22kO2Ab/CZaPEBcebfq4ONsA4uMGquJkGckdyQR5tqkNGkW0herYfFgax8AFjq913u52TjWGg5NyVoMZVjw6lo3Ex7NQRv583m8a9hVzAN8os/fooODy89JmajdKVr8a5G1HnNrTbtb8zL/uOjyoxPSmYJ9KeVjC7SQTZt3ayPh+R/67evVwjkAmwjYFqSqi2AWLfpKkbL9MiOz+2kEiJCJnYxnSBQAyYQDdE66sF9gG5ydH+RQ3yjzMUQ0cCN7AB8hNN4FCxWC8nEkpCaV6VczRpY/TFyBo2QI44gsQSxHF4frnt3BksePeOG08Iy1pcudn+G/6C6ldvW+2C1em4+F/IB0fKJ7UcT0luD4HbYLzZtk3OqQrN0pkW7BNCFLmZ40VMIAPZJ/GN+IyZT98Flr5uTG3jzU5MJ+uXvau+pD57Kd+AMVfBE1hCGj7UCd3ShXfFAe99TmHhzoHLPtd0HuGFl7H2N8GEQlgdwGUXDwELPBDlovcxGWhBszG/vkv+19eoo1q0VrceOhVblkvLl4WgXp4wg4GdgPeex3AqVh9PdUvwnrXjoFWTsbCyajMX/eNV7zCYcQ+omGYOeay0XdWD3MFI2umpcCZ9/TebAZudecsHQ2phbfG0lcyd+pyBmlc6pR1LUZfzKgZ04Xd5wHrM8rnvAVNHaL1s4SpzYv5heW9FZbGo6scjepkqut/5O7H8o8zt5vtBrcks6mBq+6V90enFedYLEIg0T5J+LxnY8b8u587OTg5+D8QLgQGMwFSZ9WeGEUPOyEfjgaedVcAxqo6lSm4AsZdASdXHMRXPtOccyp7ZT0iXsLJVQATJeeNKIwM8vsTLSFrbc+TN+FZuh2wf/JyxQib27803dy0kgV5u4zJuEd/SNmixBf6NntA6qh+7S+QgYPFtQLZkhq3luhSznlAij6PS8AIr ENOThzBw kklu8w5YGe0uqBahePiQlDhLn6D0RTiRJQwqMmPGXDCB+3MQ8GNBnND9I7SpiroFnycjjNAZGac9kdNv/1KzlNcRu4vuGio/OwSAXF39RN5+kKG7+wQkag+PlcgHMNGWVpS/N+sV8UqiEAlRWwnGy8ArzT+pK7ougEQOWLmDrC8jit72vxQAudqvO7MmGbvP7ydzoyogKUA2S4u+ZFTfoQw9Q54Vz35G5PC7QXTTkbIrUCi4LHzbLorm4AEfW0d6//Zq80RcEIhWoFcrU9MouY2uzggFFH6ULoA7mSa9ubPRhwF6OiXTByvorZBmCTRVzEwexUwgRvT7bt96BxGkfHniS5z1mwC17IGoyKnPfg1URYgplPVgsgsv97yaNWHugFsJya8/Xz2/uRhp80E7VF620CTX8kOjJxJ34XxAn+LwIegubZczREJ5+5ro4q/3LRxVKAkHfluphXYE= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000116, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Jul 11, 2023 at 11:39:55PM +1000, Greg Ungerer wrote: > The elf-fdpic loader hard sets the process personality to either > PER_LINUX_FDPIC for true elf-fdpic binaries or to PER_LINUX for > normal ELF binaries (in this case they would be constant displacement > compiled with -pie for example). The problem with that is that it > will lose any other bits that may be in the ELF header personality > (such as the "bug emulation" bits). > > On the ARM architecture the ADDR_LIMIT_32BIT flag is used to signify > a normal 32bit binary - as opposed to a legacy 26bit address binary. > This matters since start_thread() will set the ARM CPSR register as > required based on this flag. If the elf-fdpic loader loses this bit > the process will be mis-configured and crash out pretty quickly. > > Modify elf-fdpic loaders personality setting for ELF binaries so that > it preserves the upper three bytes by using the SET_PERSONALITY macro > to set it. This macro in the generic case sets PER_LINUX but and > preserves the upper bytes. Architectures can override this for their > specific use case, and ARM does exactly this. Thanks for tracking this down! There are some twisty macros in use across all the architectures here! I notice the bare set_personality() call remains, though. Is that right? For example, ARM (and sh and xtensa) also sets: #define elf_check_fdpic(x) ((x)->e_ident[EI_OSABI] == ELFOSABI_ARM_FDPIC) so it's possible the first half of the "if" below could get executed, and ARM (and possibly other architectures) would again lose the other flags, if I'm reading correctly. (And the fact that PER_LINUX is actually 0x0 is oddly handled, leaving it implicit in most architectures.) What seems perhaps more correct is to remove the "if" entirely and make sure that SET_PERSONALITY() checks the header flags on all architectures? But I'm less familiar with this area, so please let me know what I'm missing. :) > > Signed-off-by: Greg Ungerer > --- > > Is anyone out there using elf-fdpic on ARM? It would seem you're the first? :) (_Should_ it be usable on ARM?) -Kees > This seems to break it rather badly due to the loss of that ADDR_LIMIT_32BIT > bit from the process personality. > > fs/binfmt_elf_fdpic.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c > index a05eafcacfb2..f29ae1d96fd7 100644 > --- a/fs/binfmt_elf_fdpic.c > +++ b/fs/binfmt_elf_fdpic.c > @@ -348,7 +348,7 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm) > if (elf_check_fdpic(&exec_params.hdr)) > set_personality(PER_LINUX_FDPIC); > else > - set_personality(PER_LINUX); > + SET_PERSONALITY(exec_params.hdr); > if (elf_read_implies_exec(&exec_params.hdr, executable_stack)) > current->personality |= READ_IMPLIES_EXEC; > > -- > 2.25.1 > -- Kees Cook