From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id CFA4CC54798 for ; Tue, 27 Feb 2024 15:36:17 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2172F6B01A5; Tue, 27 Feb 2024 10:36:17 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 1C6E66B01A6; Tue, 27 Feb 2024 10:36:17 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 08E766B01A8; Tue, 27 Feb 2024 10:36:17 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id EEB7D6B01A5 for ; Tue, 27 Feb 2024 10:36:16 -0500 (EST) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 9A92C1C0C10 for ; Tue, 27 Feb 2024 15:36:16 +0000 (UTC) X-FDA: 81837985152.03.D8EFB95 Received: from out03.mta.xmission.com (out03.mta.xmission.com [166.70.13.233]) by imf04.hostedemail.com (Postfix) with ESMTP id 69D4C40026 for ; Tue, 27 Feb 2024 15:36:14 +0000 (UTC) Authentication-Results: imf04.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=xmission.com; spf=pass (imf04.hostedemail.com: domain of ebiederm@xmission.com designates 166.70.13.233 as permitted sender) smtp.mailfrom=ebiederm@xmission.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1709048174; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xbe+GxVP0Ho0PwHKjdhfjf1AvnwpaWbQ7DBZZQvgrR4=; b=U1Ggg6VHTq9xYRUwWs0qAtgsTZq26vZWJA2F/+OIQbiZAdsOQRsCas2JTINyPa1u4WQr/4 5GvvOPK9ug6RnrucU3DH7M+pFVHiUHsmhHHfXVW5rzaLubxNKzsbJGg1lUoy+bF5dcsJMH ZpPUHVIBIaZlCS/yOR51Hnk02p+Z2l0= ARC-Authentication-Results: i=1; imf04.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=xmission.com; spf=pass (imf04.hostedemail.com: domain of ebiederm@xmission.com designates 166.70.13.233 as permitted sender) smtp.mailfrom=ebiederm@xmission.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1709048174; a=rsa-sha256; cv=none; b=ZrctscfNkQL4vRieJzHjEkQKoEAsfFcr6NHhco4hFy8JkV1hRr9xnb5phdNC+LJvexQ03w BZQjUzI88lz4ZS/EZ9aOShq2VIrWwyJZxFcQMVvtvpwAnSJQpmyPe9sUGZ6uU7XtVoJBBh APQpQOmUptgyh4HJJlzFIl+AHXCgV20= Received: from in02.mta.xmission.com ([166.70.13.52]:55678) by out03.mta.xmission.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1rezV2-008pdi-Mz; Tue, 27 Feb 2024 08:36:08 -0700 Received: from ip68-227-168-167.om.om.cox.net ([68.227.168.167]:42208 helo=email.froward.int.ebiederm.org.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1rezV1-009PTZ-Ga; Tue, 27 Feb 2024 08:36:08 -0700 From: "Eric W. Biederman" To: Kees Cook Cc: Jan Bujak , Pedro Falcato , linux-mm@kvack.org, linux-kernel@vger.kernel.org, viro@zeniv.linux.org.uk, brauner@kernel.org, linux-fsdevel@vger.kernel.org References: <202402261821.F2812C9475@keescook> Date: Tue, 27 Feb 2024 09:35:39 -0600 In-Reply-To: <202402261821.F2812C9475@keescook> (Kees Cook's message of "Mon, 26 Feb 2024 18:23:15 -0800") Message-ID: <878r35rkc4.fsf@email.froward.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1rezV1-009PTZ-Ga;;;mid=<878r35rkc4.fsf@email.froward.int.ebiederm.org>;;;hst=in02.mta.xmission.com;;;ip=68.227.168.167;;;frm=ebiederm@xmission.com;;;spf=pass X-XM-AID: U2FsdGVkX1+N1hetAe26OvEK48+xJsS4k19zKBNTClY= X-SA-Exim-Connect-IP: 68.227.168.167 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: Recent-ish changes in binfmt_elf made my program segfault X-SA-Exim-Version: 4.2.1 (built Sat, 08 Feb 2020 21:53:50 +0000) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: 69D4C40026 X-Stat-Signature: aafpnyckcytd8rsujp9esxkp9bkjmwsp X-Rspam-User: X-HE-Tag: 1709048174-257503 X-HE-Meta: U2FsdGVkX19S78wGotH8NNtP0gFTHU4gPUfNiwHENaKi+t5q3Woj6MEqUYu2icmrg78JGhX3grE06xQ1dx9mGUzdz2LExnLyB15BzMuhnpjB9CFonbcfgNWgZ0OJFUh52Bg6gKxNedBg22Pkf/SpX6q3mMO0SB6sGttnWb+6R0fPRt/e4OvF579TTABYkJafhVhPOuPZxM20xi/GmhrUiApg9QMGJspT/MQaM//CFWzUPDEdNZQ8ZPAOhdxJgSJWbwXlvyqEGCVBvZEWIYlbnKmGOvI1h/h/eXHQbDuL43NK+l42v+GUwUCKgfoWRbBMzi0Pkcsi5h3wEKuFTmG9K/0Xr+SGAmPlQQS6cy3Bd5LAUTf47J7UxxBAKGwRIb4WGVGc9NA5mp1MNHn2qOXEPP43POuY/pm574QmpUgoj4BtiG1HQ7BiNlmUqZTV5htV1urIfVJleM6NN521R/FtLjStNt+yeFyWV07FshZxj/Z1r9HkUUP3w7KXYtwz6L9Jc9Twq4o+E/o6CkytGZXNfYAaoJipuM7Oq7oVck/BuiGwSo+utPI0phIFpqJvqrOBWOnqweFDDqAz2PypJ7+hQHvhd42vQ2qlgeNzbwC0BVAmHBVGYAjhfTmiOIkRvRKUHfkPPzysbHDqQh42GGGMuR2D5cDDrP8AK76X2KiPvGjGOy0LoM/Hg+PkuhKcz2r96bgZ8PmV+N3wThG3bZwRl0WvGFwj1bYyQVOpq6Vjg/o5YN/hl0ZI66Iy28t5NSMpbvG7dVjykuK6LULGVypDS3s2E8i8FzOPIqmLdYu5MSS1LERwipSQEfTlnUvoG8I+Px/oNdRWCPo9M4ZbsOqukoJ4MovJG+bhNKJsYxosKzvMO2RqFfvyU8XAnJsjsI23GfKKC7rp810= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Kees Cook writes: > On Tue, Jan 23, 2024 at 12:23:27AM +0900, Jan Bujak wrote: >> On 1/22/24 23:54, Pedro Falcato wrote: >> > Hi! >> > >> > Where did you get that linker script? >> > >> > FWIW, I catched this possible issue in review, and this was already >> > discussed (see my email and Eric's reply): >> > https://lore.kernel.org/all/CAKbZUD3E2if8Sncy+M2YKncc_Zh08-86W6U5wR0ZMazShxbHHA@mail.gmail.com/ >> > >> > This was my original testcase >> > (https://github.com/heatd/elf-bug-questionmark), which convinced the >> > loader to map .data over a cleared .bss. Your bug seems similar, but >> > does the inverse: maps .bss over .data. >> > >> >> I wrote the linker script myself from scratch. > > Do you still need this addressed, or have you been able to adjust the > linker script? (I ask to try to assess the priority of needing to fix > this behavior change...) Kees, I haven't had a chance to test this yet but it occurred to me that there is an easy way to handle this. In our in-memory copy of the elf program headers we can just merge the two segments together. I believe the diff below accomplishes that, and should fix issue. Signed-off-by: "Eric W. Biederman" diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 5397b552fbeb..01df7dd1f3b4 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -924,6 +926,31 @@ static int load_elf_binary(struct linux_binprm *bprm) elf_ppnt = elf_phdata; for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) switch (elf_ppnt->p_type) { + case PT_LOAD: + { + /* + * Historically linux ignored all but the + * final .bss segment. Now that linux honors + * all .bss segments, a .bss segment that + * logically is not overlapping but is + * overlapping when it's edges are rounded up + * to page size causes programs to fail. + * + * Handle that case by merging .bss segments + * into the segment they follow. + */ + if (((i + 1) >= elf_ex->e_phnum) || + (elf_ppnt[1].p_type != PT_LOAD) || + (elf_ppnt[1].p_filesz != 0)) + continue; + unsigned long end = + elf_ppnt[0].p_vaddr + elf_ppnt[0].p_memsz; + if (elf_ppnt[1].p_vaddr != end) + continue; + elf_ppnt[0].p_memsz += elf_ppnt[1].p_memsz; + elf_ppnt[1].p_type = PT_NULL; + break; + } case PT_GNU_STACK: if (elf_ppnt->p_flags & PF_X) executable_stack = EXSTACK_ENABLE_X;