From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09090C4167B for ; Tue, 7 Nov 2023 00:04:23 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 823AD8D002F; Mon, 6 Nov 2023 19:04:23 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 7D39C8D0001; Mon, 6 Nov 2023 19:04:23 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6742E8D002F; Mon, 6 Nov 2023 19:04:23 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 58B988D0001 for ; Mon, 6 Nov 2023 19:04:23 -0500 (EST) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 33858B5A1A for ; Tue, 7 Nov 2023 00:04:23 +0000 (UTC) X-FDA: 81429211206.06.1BE9FE8 Received: from mail-oi1-f177.google.com (mail-oi1-f177.google.com [209.85.167.177]) by imf18.hostedemail.com (Postfix) with ESMTP id 4A69D1C0008 for ; Tue, 7 Nov 2023 00:04:21 +0000 (UTC) Authentication-Results: imf18.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=SLaqu3Ie; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf18.hostedemail.com: domain of keescook@chromium.org designates 209.85.167.177 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1699315461; a=rsa-sha256; cv=none; b=cBVRU7v4VbxVizpIL3h3xkMr7WTFuYhex7esH8W4p78o4KX1aMVdE+oP057gyXqkRk6oUb 0wzwTVx0P4hfEuOUa11rhQYeCp80TH3zSdJJ0NYyY6W2m1m/JsmjW5YWdQw0jhRMN6LUj0 xRQzrzvDTo77g4u80tiQl1y6QOYa/Ag= ARC-Authentication-Results: i=1; imf18.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=SLaqu3Ie; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf18.hostedemail.com: domain of keescook@chromium.org designates 209.85.167.177 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1699315461; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=0HO/wA9PqUNYiMdOQK9wuMf/On/ruAp85W0UZdzlNes=; b=D3mOLFJor59fAMQwtaBURW8y+FuKYDtNoP98/wyJJ40zFwDf3/r/y5mFvxw/5wrUHdUU55 UyvyCDvjtO2N3vqu5wauXU3YdZZyD7a1qWZFHzToPqtvXvZzzDkxjHfl3yOAIL92i7Mphr bvmVMUzWNNRuYnUDcLzq7ssjyiWo89c= Received: by mail-oi1-f177.google.com with SMTP id 5614622812f47-3b2df2fb611so3600756b6e.0 for ; Mon, 06 Nov 2023 16:04:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1699315460; x=1699920260; darn=kvack.org; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:from:to :cc:subject:date:message-id:reply-to; bh=0HO/wA9PqUNYiMdOQK9wuMf/On/ruAp85W0UZdzlNes=; b=SLaqu3IeSTg0L24QI/kqQAG7VSyfxYvdG9duhjRiWpMV7CMIXvrMvpIM2L1IdWByNo t9BG2rlOhu5gNy32CsK/ZVham/gLN9pSZxd2mn5QFOq9EP+vVhdehGISt+uOTrQ6O85f asVgct3FY8Ev4qSlpvDNUjXkWNEjx3vkT4V6I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1699315460; x=1699920260; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=0HO/wA9PqUNYiMdOQK9wuMf/On/ruAp85W0UZdzlNes=; b=OlL2EJYfJ9byfgpJ0173b7+F2iseFSvMlwB+a9nKOXcVfvthXiBjCGZRg8yuNHWaBa /xUyfgK/XqcXBZK+6sJwGBzvOT5Ku5xYXL8vwDhWC0l7mC5WYy5CsJe3ZUOKEf20WT+/ PPGFQ/0D9djM8IOjleWdOBihlRaQPLirtq9iGoGSE2X/TjC4UESAfiBgDbTfZV9mXqA0 s074XSDngs0b3KCtsLXHukreLzL2XAh/ASbC1i4n00LrMWYb+8v4AeGWbxnpIZ73/yx7 SUNZk9hMi55xil96hQaOwlWXI5ndgFyBuVMih6W0pwrHeS0SvSnKBTS6T3DrtU9k2RUq J8Yw== X-Gm-Message-State: AOJu0YzftKmTVbhae2jK6WeorCT3qcTES+GH/Jcxg9MQwPkCpD35aQlN x9UkVMrp4H3g2/fjTnFePho11g== X-Google-Smtp-Source: AGHT+IGDvCB17KWTyiFx8FaXAeEJc0ByauOL7iWEfL8vBMxv+JBAAYxbbDgTQnUUhZieLx7gpEEKmw== X-Received: by 2002:a54:418f:0:b0:3b2:d9d8:4039 with SMTP id 15-20020a54418f000000b003b2d9d84039mr34224764oiy.24.1699315460292; Mon, 06 Nov 2023 16:04:20 -0800 (PST) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id y40-20020a056a00182800b006be0fb89ac3sm6111825pfa.30.2023.11.06.16.04.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Nov 2023 16:04:19 -0800 (PST) Date: Mon, 6 Nov 2023 16:04:18 -0800 From: Kees Cook To: Sasha Levin Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, "Eric W. Biederman" , Sebastian Ott , Thomas =?iso-8859-1?Q?Wei=DFschuh?= , Pedro Falcato , viro@zeniv.linux.org.uk, brauner@kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org Subject: Re: [PATCH AUTOSEL 6.6 05/13] binfmt_elf: Support segments with 0 filesz and misaligned starts Message-ID: <202311061603.CBBBC6408@keescook> References: <20231106231435.3734790-1-sashal@kernel.org> <20231106231435.3734790-5-sashal@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20231106231435.3734790-5-sashal@kernel.org> X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 4A69D1C0008 X-Stat-Signature: 987xdsdka85tt3rcbydbty1o3m3s5yc9 X-HE-Tag: 1699315461-826380 X-HE-Meta: U2FsdGVkX1+ZmXp+Va+YGbIcL8rwW4u2bRAy7ug480mNpqlXsPKV9xQ9qIrxxUpoyX9bn5BYwR+eqoNMlwsNHi+/aRRwJnn2iSxgTpVONzQaVyE8V74vINVZc8bjRn6AAYDv+neOio0cfr2k1VldycEaMUAJ9oHXg6J1kAzMrjFBoV/PxgU9CNmYlxx5NPJgAeHmNiUO5DXL8PGLKDeuTNcYzrfLUenFkG6gVldlHLC3r+xC/8SPcohKAgD4ZDxT5u8V7kXRmlDpTNcAkPb4i3+fzl5Z9BIokZ0G8MJMDA8GNY+jcQFiP/Q4vQQtLs/Zokk+Y/DUH9uXPrf7SqYg/Sj0N4n+kkOjOHRg+9+lKlr0E0jtNIwuxniCBziz201HlpBA1ln/jBjKM0uoAeUB+aGc/GrhwtK6aEwIU+mkFyaiQpLqdqI2FFA8+ta8zVoYD5WxQngIR4Owb04ADUHJvKxE61RsZFpDo4bJdrLa8SgOb7tIbPGVH+q2tCDdlFM4STrBZJ8zRWD9Kh1SoYUYoXR305+7SfROAJqH7ewq+hCq440iQtfzxqMvcNLv5b9XhV33OCJzG6Vc+Hiufm77JFwxHzd0MI7K4L/8H8hgcauAWp2DthDjS84clQcehrLJpgQxU+5/BTIx9DEnzoS6nVz3krQksb0n2zqTmjQ4gS8KBPbfmb4w7VFt4M2klZ58azJbOUYNUYK9gi6QsLo5LavQbKaHaUzTlfoY49kLvBUU4YCM1afVDwc4IAnsnSC49/f5meiBOJXS2UI7BtKxT0f8ERogEynWdACEkccS0ukVHKS2WzTIxesJSu9jr0jAOpmOOY91ISGfPP3xIgpFH6yrH0ehP9f7feQLjWf42qpF4mkrlgLxG07XcmS/7BN/cvFBHQijC/yi4ZLWXebxpCV7SQGW+dBd9VeH4FelSW1M6db/3Z1xlW7pLz3+s5vmNjjZ7a6YQQnVfC+t73U /WQJ7h0V +ndM1KzGOY7PQh9dMtCDJ7ctRfevmv6mLyUa/fVX+CFCGcYeZPGUsAwm0Pnsue3w3wumwF/vhmj1FBUYOdwj6w2qpIIEDwrDApyphhqeOCc7135hIGSH5Awcu6iuqQfU3AQpfiPmK7yL4D81Q5+3z99KPzl695wgM5n/yjQNJkx6VGsBA1ZnSbXZueBphzY11PwNItYSj1hgnwUeB+a/bXq0/PV5SwSDNV+eotA8kmuK1pcBBtm6r0vwziXqLyVnmNHrCti8khlkO7rdDlb7YIRDW/jNVJmYTHH0fuBPTpDj4AHsAKJLSvKDkIrkIbR6HV+1wmvEaJn+zIwFxoOd6FZqjdpvpB9t/vzbr2SA2sYO3yZ5IJ++RYjKgtkgFklWjomgiFKSYE0sAgrMMQ8UQlvfBitmAkkeWXP1335pCoO1RbhtY9oYZ+klYhDmKSYIQxSr/lxssHwhfh+rQVuQUbP/gshECBgLsf3dA+RN9R6RsqLfr6avfgz6nApo1t0/Fg7Rqz/jgpi7Gy5G+/172ErV2sgUbFkeU+xGroXVpq+nEsRBi2tMlQ9J5ac7Y0JX1faTx6Bd93pNzlTJ4jtCRwLms3ge1VXzmBqyFOh4rcpKYOVeRR8CCf+1CCsnu2B3cSWssL/j7adCmboANDW2MPNVFUYEDbO0Uojz2LHxXaMff22e0MrmqGPCoFp528IuHjGtJH7HF1Exs1PIB+JsWWFKbo1HVwDIJm9A0wHSGgYMJ1gce8oi9OniBwB3eYVKR18Os+WDDuYs2s2LIcic9Aq3FAgq+us4o6V9LTeRU8GJJ+w6KzWdVag2qFWAqUW9vaNlvnl2WC3yMRTgvzYiJfffserIptpO7ayEhUxm14YxRWU33U30UDVWTkA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Please drop this from -stable -- it's part of a larger refactoring that shouldn't be backported without explicit effort/testing. -Kees On Mon, Nov 06, 2023 at 06:14:18PM -0500, Sasha Levin wrote: > From: "Eric W. Biederman" > > [ Upstream commit 585a018627b4d7ed37387211f667916840b5c5ea ] > > Implement a helper elf_load() that wraps elf_map() and performs all > of the necessary work to ensure that when "memsz > filesz" the bytes > described by "memsz > filesz" are zeroed. > > An outstanding issue is if the first segment has filesz 0, and has a > randomized location. But that is the same as today. > > In this change I replaced an open coded padzero() that did not clear > all of the way to the end of the page, with padzero() that does. > > I also stopped checking the return of padzero() as there is at least > one known case where testing for failure is the wrong thing to do. > It looks like binfmt_elf_fdpic may have the proper set of tests > for when error handling can be safely completed. > > I found a couple of commits in the old history > https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git, > that look very interesting in understanding this code. > > commit 39b56d902bf3 ("[PATCH] binfmt_elf: clearing bss may fail") > commit c6e2227e4a3e ("[SPARC64]: Missing user access return value checks in fs/binfmt_elf.c and fs/compat.c") > commit 5bf3be033f50 ("v2.4.10.1 -> v2.4.10.2") > > Looking at commit 39b56d902bf3 ("[PATCH] binfmt_elf: clearing bss may fail"): > > commit 39b56d902bf35241e7cba6cc30b828ed937175ad > > Author: Pavel Machek > > Date: Wed Feb 9 22:40:30 2005 -0800 > > > > [PATCH] binfmt_elf: clearing bss may fail > > > > So we discover that Borland's Kylix application builder emits weird elf > > files which describe a non-writeable bss segment. > > > > So remove the clear_user() check at the place where we zero out the bss. I > > don't _think_ there are any security implications here (plus we've never > > checked that clear_user() return value, so whoops if it is a problem). > > > > Signed-off-by: Pavel Machek > > Signed-off-by: Andrew Morton > > Signed-off-by: Linus Torvalds > > It seems pretty clear that binfmt_elf_fdpic with skipping clear_user() for > non-writable segments and otherwise calling clear_user(), aka padzero(), > and checking it's return code is the right thing to do. > > I just skipped the error checking as that avoids breaking things. > > And notably, it looks like Borland's Kylix died in 2005 so it might be > safe to just consider read-only segments with memsz > filesz an error. > > Reported-by: Sebastian Ott > Reported-by: Thomas Weißschuh > Closes: https://lkml.kernel.org/r/20230914-bss-alloc-v1-1-78de67d2c6dd@weissschuh.net > Signed-off-by: "Eric W. Biederman" > Link: https://lore.kernel.org/r/87sf71f123.fsf@email.froward.int.ebiederm.org > Tested-by: Pedro Falcato > Signed-off-by: Sebastian Ott > Link: https://lore.kernel.org/r/20230929032435.2391507-1-keescook@chromium.org > Signed-off-by: Kees Cook > Signed-off-by: Sasha Levin > --- > fs/binfmt_elf.c | 111 +++++++++++++++++++++--------------------------- > 1 file changed, 48 insertions(+), 63 deletions(-) > > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c > index 7b3d2d4914073..2a615f476e44e 100644 > --- a/fs/binfmt_elf.c > +++ b/fs/binfmt_elf.c > @@ -110,25 +110,6 @@ static struct linux_binfmt elf_format = { > > #define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE)) > > -static int set_brk(unsigned long start, unsigned long end, int prot) > -{ > - start = ELF_PAGEALIGN(start); > - end = ELF_PAGEALIGN(end); > - if (end > start) { > - /* > - * Map the last of the bss segment. > - * If the header is requesting these pages to be > - * executable, honour that (ppc32 needs this). > - */ > - int error = vm_brk_flags(start, end - start, > - prot & PROT_EXEC ? VM_EXEC : 0); > - if (error) > - return error; > - } > - current->mm->start_brk = current->mm->brk = end; > - return 0; > -} > - > /* We need to explicitly zero any fractional pages > after the data section (i.e. bss). This would > contain the junk from the file that should not > @@ -406,6 +387,51 @@ static unsigned long elf_map(struct file *filep, unsigned long addr, > return(map_addr); > } > > +static unsigned long elf_load(struct file *filep, unsigned long addr, > + const struct elf_phdr *eppnt, int prot, int type, > + unsigned long total_size) > +{ > + unsigned long zero_start, zero_end; > + unsigned long map_addr; > + > + if (eppnt->p_filesz) { > + map_addr = elf_map(filep, addr, eppnt, prot, type, total_size); > + if (BAD_ADDR(map_addr)) > + return map_addr; > + if (eppnt->p_memsz > eppnt->p_filesz) { > + zero_start = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) + > + eppnt->p_filesz; > + zero_end = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) + > + eppnt->p_memsz; > + > + /* Zero the end of the last mapped page */ > + padzero(zero_start); > + } > + } else { > + map_addr = zero_start = ELF_PAGESTART(addr); > + zero_end = zero_start + ELF_PAGEOFFSET(eppnt->p_vaddr) + > + eppnt->p_memsz; > + } > + if (eppnt->p_memsz > eppnt->p_filesz) { > + /* > + * Map the last of the segment. > + * If the header is requesting these pages to be > + * executable, honour that (ppc32 needs this). > + */ > + int error; > + > + zero_start = ELF_PAGEALIGN(zero_start); > + zero_end = ELF_PAGEALIGN(zero_end); > + > + error = vm_brk_flags(zero_start, zero_end - zero_start, > + prot & PROT_EXEC ? VM_EXEC : 0); > + if (error) > + map_addr = error; > + } > + return map_addr; > +} > + > + > static unsigned long total_mapping_size(const struct elf_phdr *phdr, int nr) > { > elf_addr_t min_addr = -1; > @@ -829,7 +855,6 @@ static int load_elf_binary(struct linux_binprm *bprm) > struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; > struct elf_phdr *elf_property_phdata = NULL; > unsigned long elf_bss, elf_brk; > - int bss_prot = 0; > int retval, i; > unsigned long elf_entry; > unsigned long e_entry; > @@ -1040,33 +1065,6 @@ static int load_elf_binary(struct linux_binprm *bprm) > if (elf_ppnt->p_type != PT_LOAD) > continue; > > - if (unlikely (elf_brk > elf_bss)) { > - unsigned long nbyte; > - > - /* There was a PT_LOAD segment with p_memsz > p_filesz > - before this one. Map anonymous pages, if needed, > - and clear the area. */ > - retval = set_brk(elf_bss + load_bias, > - elf_brk + load_bias, > - bss_prot); > - if (retval) > - goto out_free_dentry; > - nbyte = ELF_PAGEOFFSET(elf_bss); > - if (nbyte) { > - nbyte = ELF_MIN_ALIGN - nbyte; > - if (nbyte > elf_brk - elf_bss) > - nbyte = elf_brk - elf_bss; > - if (clear_user((void __user *)elf_bss + > - load_bias, nbyte)) { > - /* > - * This bss-zeroing can fail if the ELF > - * file specifies odd protections. So > - * we don't check the return value > - */ > - } > - } > - } > - > elf_prot = make_prot(elf_ppnt->p_flags, &arch_state, > !!interpreter, false); > > @@ -1162,7 +1160,7 @@ static int load_elf_binary(struct linux_binprm *bprm) > } > } > > - error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, > + error = elf_load(bprm->file, load_bias + vaddr, elf_ppnt, > elf_prot, elf_flags, total_size); > if (BAD_ADDR(error)) { > retval = IS_ERR_VALUE(error) ? > @@ -1217,10 +1215,8 @@ static int load_elf_binary(struct linux_binprm *bprm) > if (end_data < k) > end_data = k; > k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; > - if (k > elf_brk) { > - bss_prot = elf_prot; > + if (k > elf_brk) > elf_brk = k; > - } > } > > e_entry = elf_ex->e_entry + load_bias; > @@ -1232,18 +1228,7 @@ static int load_elf_binary(struct linux_binprm *bprm) > start_data += load_bias; > end_data += load_bias; > > - /* Calling set_brk effectively mmaps the pages that we need > - * for the bss and break sections. We must do this before > - * mapping in the interpreter, to make sure it doesn't wind > - * up getting placed where the bss needs to go. > - */ > - retval = set_brk(elf_bss, elf_brk, bss_prot); > - if (retval) > - goto out_free_dentry; > - if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) { > - retval = -EFAULT; /* Nobody gets to see this, but.. */ > - goto out_free_dentry; > - } > + current->mm->start_brk = current->mm->brk = ELF_PAGEALIGN(elf_brk); > > if (interpreter) { > elf_entry = load_elf_interp(interp_elf_ex, > -- > 2.42.0 > -- Kees Cook