From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7909E743C0 for ; Fri, 29 Sep 2023 03:24:42 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3069D8D009F; Thu, 28 Sep 2023 23:24:41 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 2B5668D0002; Thu, 28 Sep 2023 23:24:41 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1553C8D009F; Thu, 28 Sep 2023 23:24:41 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 07D288D0002 for ; Thu, 28 Sep 2023 23:24:41 -0400 (EDT) Received: from smtpin08.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id C3E0B4108B for ; Fri, 29 Sep 2023 03:24:40 +0000 (UTC) X-FDA: 81288192720.08.4EFDC5D Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) by imf08.hostedemail.com (Postfix) with ESMTP id C2667160007 for ; Fri, 29 Sep 2023 03:24:38 +0000 (UTC) Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=HAB+IOsD; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf08.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.177 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1695957878; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=q1S2QHXg38kETw2Vrnc3ITAH/+VCqfp/XhwxJe7fVnI=; b=yY1l5lD+AaTnDHtA+I3GcSn+QvLQAz5OFHTxS/ae4OvuGWKwoadwGQeephnr2WzjC/2c2J /Lgm/i2v8sYbYv+4poWQuRnt3APY1BfBgKpXzVpNlLnDipnlVG/nNLJNk0LrSltQoptAd5 24K8rfA2P2CKuqyVDs1uiGzije4z5JM= ARC-Authentication-Results: i=1; imf08.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=HAB+IOsD; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf08.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.177 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1695957878; a=rsa-sha256; cv=none; b=QDECvh4dTR2Wfl3beYjCUi2+mFRbg5IG9Uq0tG+kr6bt2gpTxInU2bSujDe8Cs+sYSQoU9 CoKOCAzhUsHbAQaZZ+WTLy0wfAqL+GxQCAoPEiwpu8fY4dvpcQ0U2XjrLGKvG4BpRUKLjt qXmCrB7pUdg3YPELiSQPhYt3OROv2B0= Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-690ce3c55f1so10758553b3a.0 for ; Thu, 28 Sep 2023 20:24:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1695957877; x=1696562677; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=q1S2QHXg38kETw2Vrnc3ITAH/+VCqfp/XhwxJe7fVnI=; b=HAB+IOsDuJH/2TAMt/4chgRWB6MBHeiJVwhY3Lk2jZnweEjJIpif9YgTpGzSQ7bc2i YqVCJ+GeIuS3RGwbda5fDSr4xFy1RdkxZY4QMDLXhnHKNQkDHPQ7VyZrEi4ChIV+67uK UpfUZaxFADOrOfOABxwnT1pGE4iSyQY+PJGsQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695957877; x=1696562677; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=q1S2QHXg38kETw2Vrnc3ITAH/+VCqfp/XhwxJe7fVnI=; b=YLNX/CTlkM3k6IarKPSFw9gQcZHXMYC/mXg/fKe5yOxUjypOu8SyErIvz5QokBAG6J sDVgbkBA8hBiexjwDVNwsHoXzfTD2VxIofziTy42y8UzhBRnmsBpep4+pGNE13UKemlk K7+crC3KeEkZHJi3o9Z0U23z7zPjH9a/FT0j4HMgO/+3awq3X3qj69l/Eyw254lSciqS yNWMpsYCn8P8Ff56jTZgEcMfU/x9dYP8vA5m1O/B5biUR0RjXrebRlVvYfWZznLG7GzP t8AgRSbc/e2LiUuC30EnipbXm1t9SRkF1tb3hCoDkPIZMxt2nHwFoftMPDq/yj3czDYM 9/SA== X-Gm-Message-State: AOJu0Yym2pMx0aAX3j10ALb1q1AgEnRLvX40TdkS8qbXMas9RgKT9Ku+ IDoYjSgw8LLMm9+f/7AMT7JNKg== X-Google-Smtp-Source: AGHT+IE41fRv5mNKe4vvztkmUzkhz9pAxOvK1Y/IqQsGTpnsnBawSfxRlm726T+ZhHtYQg36mF0ZmA== X-Received: by 2002:a05:6a20:d90b:b0:160:cc73:39ef with SMTP id jd11-20020a056a20d90b00b00160cc7339efmr2588831pzb.48.1695957877520; Thu, 28 Sep 2023 20:24:37 -0700 (PDT) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id g9-20020a170902c38900b001c7373769basm2074161plg.88.2023.09.28.20.24.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 28 Sep 2023 20:24:36 -0700 (PDT) From: Kees Cook To: Eric Biederman Cc: Kees Cook , Sebastian Ott , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Pedro Falcato , Al Viro , Christian Brauner , Andrew Morton , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH v4 1/6] binfmt_elf: Support segments with 0 filesz and misaligned starts Date: Thu, 28 Sep 2023 20:24:29 -0700 Message-Id: <20230929032435.2391507-1-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230929031716.it.155-kees@kernel.org> References: <20230929031716.it.155-kees@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-Developer-Signature: v=1; a=openpgp-sha256; l=8056; i=keescook@chromium.org; h=from:subject; bh=17HFsxzRR6qjNPl2OqeDyONMEClWu0Ld8l5K3CgB/PI=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBlFkNx9ky4C5SoI1ZcjBN8kT+abWcWJ1uQcH9Lv 1XdD+58PfSJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZRZDcQAKCRCJcvTf3G3A Jkq+D/4+ERIwd+j9kCgE3YL8f6BaEPCM1Wy540egTRyd8uxuhJLV/MjU4bGQTq5IzynPij0EVRZ AMX3Kda0AuvJ9/nAqmFqVAPvO0yR68AwteJvc5m7SSBnbNIYr6LAJ4jO+2fBU/rx9GNhwZPe6dB blk7g6mbQXiRAeKTdqGu5bjoYcZTrrQFJj91tUj9OCuNDZEr2lD4iMNVPhZfK6HO97g2NWw11kt UEcNkn69PVA0KRsMgCqWh02zT9JvaZP+ciKiHEDz1aQoPHotcJpFQqEDxUSWkGUQwlkbKrGRaf1 fcPi2kq7GTJiTxXPgxd5o7yWriWxPHNTyhKGXcbmToLSeKJBOkj8NWQIkYlv05UyEUw+gY+0WZw FJ3LNMpBDzrKiUiNWUfal8Watcpz/yp+mjIELKSDFReTXTqLQW49KvqulWYNZHPtbpVVaTmkGGu bKCHrI4wlZo/0Ea4v4V205GrLpUsbdCcsj8CpSpWGlWqb+FWHvo0dQhWmwNQEWqpSA7soBBxKsV 5Ragq8YPGzA2Xl68fzMW7FnyZCLJOeob+5SPgEzYkdiUSqO3L0nZ2V8J5Xyxo3nxEyZ5KfjGyzU 8JgId+qHNCzcdvZSiOJ6nW3Io53wtMH4PaQZLa4PNAB19C3URkhNr/gqkDCFsv4txyd8mlojxjf NlBsHU/1WHut/KA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: C2667160007 X-Rspam-User: X-Rspamd-Server: rspam05 X-Stat-Signature: yi1e7nzkbf3kn53ry9eff85mra4ucwgi X-HE-Tag: 1695957878-253250 X-HE-Meta: U2FsdGVkX1/JknHqN/Hon3jviZXx446D5xrrFlv/Q0hY7ZMnW6zGpOM8OASURiUgOnx/OjBwN3Jr4gWuktCbYUKKmzsDWQjwiLiTAonmwcj1wiJKPainVzLOKWuu+EvVz4FYrm8ZX2aEZXJAjyxJrjwtIgWRbkSl9HF750B8ZNfzUgzwV+TaqUPg3iqwN7Ox7LxVw1teYvkZRSqiYmDgmVU9uaO2zBOCv1HcVuz+cTiSjsQk7ivHrESvX7NVud9IXWjkMgczyYDvnvpsnPpeMo4vyF8A4xwp0Reeue7J426iFAi2antBrYnaEDerowQ58OULKffmtprgvlZqMySEKrou/kRltbAnVPzeF2lPXDf7sGYqX09v/2VdUhBwE/zEzHtpTwdaLQVHX7qslc1ZDtFdTts8sT/vBpUYy7eBEUFMeDLLATwCzKkUnDmm3LJs1TdbpssJcinvIh9zOmiga6TlPuUx3NRZoouFs8L/9GHwg3lKMWIbA8Y145GpeXAPNVP8i0houdinICnaiKYTM5zQNJ/s8dCHiz01QZrmSB5T5x1TgEPupLYwYu8wu8bF0KeGZPtTx+UEbqc5bXmVoLDn6Hv+T+EdEO485cxTeI+eZn+geNEDmc6Oc70u6b0kzn0dx4a5V2eiwt5i44SEywTVNF9K/TCc9DPa0trYuEGEQ7gRLukukycalgrVZ98UvpAHYuRDt3XxVKMbsn29OOaXiqQCvMZpXHE7Ej4vBlNfJfUjpTIWCA270qmGzJ9wUIrMwKyXZmggBsYByCk4ZUO3UmofuvGuR/hbW2mzl99MmkIbTtO3fhgwLEa6+TMqVE1y8lpRVRSUQWqOCNeMKi8k54hl5i3cOunmwbCrVzbX1AaZgzYT0OQ/SqZQVuZCv33ymSoXe7R6ZT6eqmiizcgWrN9io2jN+EuM7N39wrYf/8LEa+7+Kr7BGEnxPsbUdJLKQcGkRKDCbOUi0Un E+rfUKIW O84WJ3/c1pNhD56DJC4u+ICySFpMG0RFTFnD2ZhHfE7ieXeqlAvFVmJrlSKXAIQ07c4OrWmEMD+h+C8ii43DDaOsDxDbGYPia6J1WvubQTgrUSuNv5sFxnGYxxl4JgnXfUf4eM8Nsx7YRdO84yPzI/DRn0bACCkyxvRfZc1uoBGacyHQytFxlDCW7bM7K9OSmXG9LwCkR83I5iJz22BClrfRwB1YwhtdwAeX/b0OGTj6jqokZuO9wLe55YqYe3t1r6bdkEhcqkPQra3l2oV8iSZ3Gn+M+9r6oB3kBvspnMhQ1d0VeaUMCeKpv17PouFjCw53egFrqZIZkLVJCykaqZC9BKvZ8rgbdW8PnCg5I4lqSNMySlyT5aQqt6Gj1I7/S2CYvwIzy5W1puWBuhVTTr1907OeObeWrJUtdzJ0ReFhie/ttJt1NEbeMtO0qIuOg4YcdkxZDhEc3yb2ypTeulzco9zecXYdjga1ywpM7Q7+fqwV3dSalarEq7p5yuoAoaZZjoO995yXTigYRu/34x6SeNbVMQzjQWk5poWp1HNtY5iUM6TOT5NvYzl/puJ1kAmo71xWt7f03kY43z/dXZhlOeRgst7eNcDgfJ2GjM16fDW2eIXJCNZlzH83MDdvD1e1yUe8XkR0WpzCSOqs6rLIP83NCJT51fg+2/DVh64tGNcUveJuAnW6ZTqAB9jtIePL5v3uX00QhaarXnSDaC3x/oGKaBQWtJchT30OwJSWS4t+MLpTNzz5znrlyi32bguQkv7pxCoAkg++9kyIJUwKxQwgLmQ4OHRqQrWGLa3ZTZrx+fYN9uyjmiy4VwRdtyfsKgoonK+2h9bl1iJ7p4Wt1wQa+kcN5DtaJ X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: "Eric W. Biederman" Implement a helper elf_load() that wraps elf_map() and performs all of the necessary work to ensure that when "memsz > filesz" the bytes described by "memsz > filesz" are zeroed. An outstanding issue is if the first segment has filesz 0, and has a randomized location. But that is the same as today. In this change I replaced an open coded padzero() that did not clear all of the way to the end of the page, with padzero() that does. I also stopped checking the return of padzero() as there is at least one known case where testing for failure is the wrong thing to do. It looks like binfmt_elf_fdpic may have the proper set of tests for when error handling can be safely completed. I found a couple of commits in the old history https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git, that look very interesting in understanding this code. commit 39b56d902bf3 ("[PATCH] binfmt_elf: clearing bss may fail") commit c6e2227e4a3e ("[SPARC64]: Missing user access return value checks in fs/binfmt_elf.c and fs/compat.c") commit 5bf3be033f50 ("v2.4.10.1 -> v2.4.10.2") Looking at commit 39b56d902bf3 ("[PATCH] binfmt_elf: clearing bss may fail"): > commit 39b56d902bf35241e7cba6cc30b828ed937175ad > Author: Pavel Machek > Date: Wed Feb 9 22:40:30 2005 -0800 > > [PATCH] binfmt_elf: clearing bss may fail > > So we discover that Borland's Kylix application builder emits weird elf > files which describe a non-writeable bss segment. > > So remove the clear_user() check at the place where we zero out the bss. I > don't _think_ there are any security implications here (plus we've never > checked that clear_user() return value, so whoops if it is a problem). > > Signed-off-by: Pavel Machek > Signed-off-by: Andrew Morton > Signed-off-by: Linus Torvalds It seems pretty clear that binfmt_elf_fdpic with skipping clear_user() for non-writable segments and otherwise calling clear_user(), aka padzero(), and checking it's return code is the right thing to do. I just skipped the error checking as that avoids breaking things. And notably, it looks like Borland's Kylix died in 2005 so it might be safe to just consider read-only segments with memsz > filesz an error. Reported-by: Sebastian Ott Reported-by: Thomas Weißschuh Closes: https://lkml.kernel.org/r/20230914-bss-alloc-v1-1-78de67d2c6dd@weissschuh.net Signed-off-by: "Eric W. Biederman" Link: https://lore.kernel.org/r/87sf71f123.fsf@email.froward.int.ebiederm.org Signed-off-by: Kees Cook --- fs/binfmt_elf.c | 111 +++++++++++++++++++++--------------------------- 1 file changed, 48 insertions(+), 63 deletions(-) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 7b3d2d491407..2a615f476e44 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -110,25 +110,6 @@ static struct linux_binfmt elf_format = { #define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE)) -static int set_brk(unsigned long start, unsigned long end, int prot) -{ - start = ELF_PAGEALIGN(start); - end = ELF_PAGEALIGN(end); - if (end > start) { - /* - * Map the last of the bss segment. - * If the header is requesting these pages to be - * executable, honour that (ppc32 needs this). - */ - int error = vm_brk_flags(start, end - start, - prot & PROT_EXEC ? VM_EXEC : 0); - if (error) - return error; - } - current->mm->start_brk = current->mm->brk = end; - return 0; -} - /* We need to explicitly zero any fractional pages after the data section (i.e. bss). This would contain the junk from the file that should not @@ -406,6 +387,51 @@ static unsigned long elf_map(struct file *filep, unsigned long addr, return(map_addr); } +static unsigned long elf_load(struct file *filep, unsigned long addr, + const struct elf_phdr *eppnt, int prot, int type, + unsigned long total_size) +{ + unsigned long zero_start, zero_end; + unsigned long map_addr; + + if (eppnt->p_filesz) { + map_addr = elf_map(filep, addr, eppnt, prot, type, total_size); + if (BAD_ADDR(map_addr)) + return map_addr; + if (eppnt->p_memsz > eppnt->p_filesz) { + zero_start = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) + + eppnt->p_filesz; + zero_end = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) + + eppnt->p_memsz; + + /* Zero the end of the last mapped page */ + padzero(zero_start); + } + } else { + map_addr = zero_start = ELF_PAGESTART(addr); + zero_end = zero_start + ELF_PAGEOFFSET(eppnt->p_vaddr) + + eppnt->p_memsz; + } + if (eppnt->p_memsz > eppnt->p_filesz) { + /* + * Map the last of the segment. + * If the header is requesting these pages to be + * executable, honour that (ppc32 needs this). + */ + int error; + + zero_start = ELF_PAGEALIGN(zero_start); + zero_end = ELF_PAGEALIGN(zero_end); + + error = vm_brk_flags(zero_start, zero_end - zero_start, + prot & PROT_EXEC ? VM_EXEC : 0); + if (error) + map_addr = error; + } + return map_addr; +} + + static unsigned long total_mapping_size(const struct elf_phdr *phdr, int nr) { elf_addr_t min_addr = -1; @@ -829,7 +855,6 @@ static int load_elf_binary(struct linux_binprm *bprm) struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; struct elf_phdr *elf_property_phdata = NULL; unsigned long elf_bss, elf_brk; - int bss_prot = 0; int retval, i; unsigned long elf_entry; unsigned long e_entry; @@ -1040,33 +1065,6 @@ static int load_elf_binary(struct linux_binprm *bprm) if (elf_ppnt->p_type != PT_LOAD) continue; - if (unlikely (elf_brk > elf_bss)) { - unsigned long nbyte; - - /* There was a PT_LOAD segment with p_memsz > p_filesz - before this one. Map anonymous pages, if needed, - and clear the area. */ - retval = set_brk(elf_bss + load_bias, - elf_brk + load_bias, - bss_prot); - if (retval) - goto out_free_dentry; - nbyte = ELF_PAGEOFFSET(elf_bss); - if (nbyte) { - nbyte = ELF_MIN_ALIGN - nbyte; - if (nbyte > elf_brk - elf_bss) - nbyte = elf_brk - elf_bss; - if (clear_user((void __user *)elf_bss + - load_bias, nbyte)) { - /* - * This bss-zeroing can fail if the ELF - * file specifies odd protections. So - * we don't check the return value - */ - } - } - } - elf_prot = make_prot(elf_ppnt->p_flags, &arch_state, !!interpreter, false); @@ -1162,7 +1160,7 @@ static int load_elf_binary(struct linux_binprm *bprm) } } - error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, + error = elf_load(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags, total_size); if (BAD_ADDR(error)) { retval = IS_ERR_VALUE(error) ? @@ -1217,10 +1215,8 @@ static int load_elf_binary(struct linux_binprm *bprm) if (end_data < k) end_data = k; k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; - if (k > elf_brk) { - bss_prot = elf_prot; + if (k > elf_brk) elf_brk = k; - } } e_entry = elf_ex->e_entry + load_bias; @@ -1232,18 +1228,7 @@ static int load_elf_binary(struct linux_binprm *bprm) start_data += load_bias; end_data += load_bias; - /* Calling set_brk effectively mmaps the pages that we need - * for the bss and break sections. We must do this before - * mapping in the interpreter, to make sure it doesn't wind - * up getting placed where the bss needs to go. - */ - retval = set_brk(elf_bss, elf_brk, bss_prot); - if (retval) - goto out_free_dentry; - if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) { - retval = -EFAULT; /* Nobody gets to see this, but.. */ - goto out_free_dentry; - } + current->mm->start_brk = current->mm->brk = ELF_PAGEALIGN(elf_brk); if (interpreter) { elf_entry = load_elf_interp(interp_elf_ex, -- 2.34.1