Re: [PATCH] binfmt_elf: remove the 4k limitation of program header size

[Yin Fengwei <fengwei_yin@linux.alibaba.com>]

在 2025/8/3 13:28, Ismael Luceno 写道:
> On 02/Aug/2025 10:29, Kees Cook wrote:
>> On Sat, Aug 02, 2025 at 05:47:13AM +0200, Ismael Luceno wrote:
>>> On Sat, Jul 19, 2025 at 17:17:09 +0800, YinFengwei wrote:
>>>> On Thu, Jul 17, 2025 at 04:31:50PM +0800, Kees Cook wrote:
>>>>> On Thu, 17 Jul 2025 19:01:08 +0800, fengwei_yin@linux.alibaba.com wrote:
>>>>>> We have assembly code generated by a script. GCC successfully compiles
>>>>>> it. However, the kernel cannot load it on an ARM64 platform with a 4K
>>>>>> page size. In contrast, the same ELF file loads correctly on the same
>>>>>> platform with a 64K page size.
>>>>>>
>>>>>> The root cause is the Linux kernel's ELF_MIN_ALIGN limitation on the
>>>>>> program headers of ELF files. The ELF file contains 78 program headers
>>>>>> (the script inserts many holes when generating the assembly code). On
>>>>>> ARM64 with a 4K page size, the ELF_MIN_ALLIGN enforces a maximum of 74
>>>>>> program headers, causing the ELF file to fail. However, with a 64K page
>>>>>> size, the ELF_MIN_ALIGN is relaxed to over 1,184 program headers, allowing
>>>>>> the file to run correctly.
>>>>>>
>>>>>> [...]
>>>>>
>>>>> Applied to for-next/execve, thanks!
>>>> Cook, thanks a lot.
>>>>
>>>> Regards
>>>> Yin, Fengwei
>>>>
>>>>>
>>>>> [1/1] binfmt_elf: remove the 4k limitation of program header size
>>>>>        https://git.kernel.org/kees/c/8030790477e8
>>>>>
>>>>> Take care,
>>>
>>> Hi,
>>>
>>> I noticed this removal and wonder whether it could be a problem on
>>> smaller platforms.
>>>
>>> IIRC that code has been there since ELF support was added in one
>>> form or another; and the idea behind it was to simplify the code
>>> by ensuring no cross-page reads could happen, as these could cause
>>> undefined behaviours or read abort exceptions.
>>
>> I didn't see a place where that would happen -- the reads aren't done on
>> a single page. If you see something that I missed, please let me know!
> 
> The offset to the phdrs can point anywhere and the entries are
> arbitrarily sized, thus it can be unaligned, so we can be potentially
> reading at an entry right between two pages.

The read buffer are managed in kernel. Why cross-page read can cause
undefined behaviors or read abort?

Does smaller platforms have special behavior in this situation? Like
can't do cross-page read against the buffer allocated by kmalloc?


Regards
Yin, Fengwei