From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A27AE728C0 for ; Fri, 29 Sep 2023 15:40:03 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C9A8E6B020F; Fri, 29 Sep 2023 11:40:02 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C4AA06B0213; Fri, 29 Sep 2023 11:40:02 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AEB1C6B0248; Fri, 29 Sep 2023 11:40:02 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 9C2C66B020F for ; Fri, 29 Sep 2023 11:40:02 -0400 (EDT) Received: from smtpin24.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 6D2D4120546 for ; Fri, 29 Sep 2023 15:40:02 +0000 (UTC) X-FDA: 81290045844.24.6E82920 Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232]) by imf12.hostedemail.com (Postfix) with ESMTP id F1CDA4001A for ; Fri, 29 Sep 2023 15:39:59 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=xmission.com; spf=pass (imf12.hostedemail.com: domain of ebiederm@xmission.com designates 166.70.13.232 as permitted sender) smtp.mailfrom=ebiederm@xmission.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1696002000; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5KO2W0g72dpzLOyv7dI40rngM73zkvEhpnRevIEkuag=; b=vSF7mx0ixMEQnh2Gl9R5KalEfu8gB1jBF4F09Q5aPRoOz7Cx02aRBNX2y+6IGd4HB5QozK c4aNJtx8JpF/suDtJxHlUpzBCMYzabaaqnDwcT1uPaHrDA1qJ0L5SL5Oi4iXO4ckSwkE36 hwka1HuIhAw2Lltcu2N3h9dmg4W38rs= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=xmission.com; spf=pass (imf12.hostedemail.com: domain of ebiederm@xmission.com designates 166.70.13.232 as permitted sender) smtp.mailfrom=ebiederm@xmission.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1696002000; a=rsa-sha256; cv=none; b=7NaDulMF+dCmqb3k9Bt6ZZTPdmmPlmw7VE0RsWhUrUw8MAsGqpIkrkbg4nrp3qwgXSXOr/ rWzF6st8SeaCdoEkUscrbpZblBGRgLSe9lBJfr//GORmbPWAOuZc64pyRal7lOEdchqIwD YhpBa6J7bLbd5mSOIaVe5qkx9bdCoX8= Received: from in02.mta.xmission.com ([166.70.13.52]:43516) by out02.mta.xmission.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1qmFaw-007Gkh-87; Fri, 29 Sep 2023 09:39:58 -0600 Received: from ip68-227-168-167.om.om.cox.net ([68.227.168.167]:35744 helo=email.froward.int.ebiederm.org.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1qmFat-00H6Yy-NC; Fri, 29 Sep 2023 09:39:57 -0600 From: "Eric W. Biederman" To: Pedro Falcato Cc: Kees Cook , Sebastian Ott , Thomas =?utf-8?Q?Wei=C3=9Fschuh?= , Al Viro , Christian Brauner , Andrew Morton , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org References: <20230929031716.it.155-kees@kernel.org> Date: Fri, 29 Sep 2023 10:39:48 -0500 In-Reply-To: (Pedro Falcato's message of "Fri, 29 Sep 2023 12:58:18 +0100") Message-ID: <87jzs96la3.fsf@email.froward.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-XM-SPF: eid=1qmFat-00H6Yy-NC;;;mid=<87jzs96la3.fsf@email.froward.int.ebiederm.org>;;;hst=in02.mta.xmission.com;;;ip=68.227.168.167;;;frm=ebiederm@xmission.com;;;spf=pass X-XM-AID: U2FsdGVkX1978eUsRurBCHqZn1jQUDAnUa0SmxZia2o= X-SA-Exim-Connect-IP: 68.227.168.167 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [PATCH v4 0/6] binfmt_elf: Support segments with 0 filesz and misaligned starts X-SA-Exim-Version: 4.2.1 (built Sat, 08 Feb 2020 21:53:50 +0000) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) X-Rspamd-Queue-Id: F1CDA4001A X-Rspam-User: X-Rspamd-Server: rspam02 X-Stat-Signature: iaa14mqwaxyntmfwe6nbtj6c5h1xg6hj X-HE-Tag: 1696001999-228745 X-HE-Meta: U2FsdGVkX1/ysLS/9pwJ3KB3DAlS7h9mwPQ3UvBHI7y7P8TdkUXhWDY0rulPpKkXAqbyUCiOXzMupVZRBAWx/KtPGzx06jao9/68FzEImAcfjhTHdwvlk0icbuZLt+W/mlEN7ZMFgYpufSaCxdQR+Nr0LEPZ4fahk+YZeDa54Lg/vE4+19Khu73ioV3LcdmHAfSXIPCwJa9fC/228BXNFEll7pVG7tuuGinrjmBX1v//ek0AcWlO55llOvEq6p2FyseWoutb34TBPZjnhE8Qm4uTROLgClHXoLUC0pWLIcQNLun2edTxiAghIXzHud+proJqr3zm1R6iVE/XF+78YKLl62Vz3bHJzi0ZvqegRk51Y0X4U+SAIqzeq46CCIFxzBrftYA4ykNLONZE596z7QbnRiRYnzaHMVc9MXhGAP4Hvcx6GHnG2eLFu2avaMb3DJXgozWTKSqAcGT1UTW9ZzJr/KdfwNAZAZM/IYWSCGF7eRgZd/hFBFgIQgUzYejU1vQBOtuN9IsIFF0JK23fK2gthep4F7MMaj7eX4Yin4tFg2M9vSBxJSXOFh+RkM/si5qIT5lkL1ZnfY9g2PCn3XAr002xxpGYiU9Q4FDfoRTMsePlAROESkKNGDXk0ie8VXbfgGUBK9zZLpirepeC9CAUt4HbKx95kHyeOOyofQXUGcbbvJGLQKvgxnSOgASqNof0wnbndvZeXC3htpeQ5oHwJnjHJtDo+rlh8+V+1kaKh7tMLZdgmsLWZ/w0CCYyViv/LkQ9Fu69uBBA8+Oedp8+Bx/UwrInU2LsAvFnbXnMT3aPE37EFI5Pq9uDc+YRt/2+99kz8pd2JNL1DBarIruqYo7/kQgrexZ+1Oeizsj22Xi2MqARZUoJkOALKSyi9BNO07NNZAdNp+YLaXxgPw29ogsIPFIXsbNDkEBqmVgfI11/dFzCOXsxQHiaLzg4pLuWbCYF2fG161oqOqO nTg4jt7C PcLRQgPhe1JaU2qSAEEYlevr9L3Yk53+oSPhJggrCIGSolFDhVaRhgWPvQmJXnQJrCjvWzyMFZJkjyfKX0zbnE4KOfMa+9VUot+fvHqmTWnQN+ez7h1NEy3fY0ycz71A9PqfaURAzXW6gVMkfuKdaFqg5StWlcdDrddsal05WMk51OBLGnPjeU18mEj7QQOUijAaHPh7nQ7gwoevs/VWL6VOFcBqT6R6u2B7vHny5dxPOwZ07YBj4GkfhBSsURXPMKIapnwHTZR5M5JfYaumkP8p6TkgWCt/f9loejEAHslXIfcUDsA9R8OkeOksjgmyC4ImMDlZ4vLWiZWhAXA8UAjvnmkNJuF3HUptu90ammfXFnzCbbou0KnJEhdD56RZAOvBGagDBVfymmh7XvDSErs5kZoSwky+C7tpdsQ+W69RZWETWwUzygYI7kg== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Pedro Falcato writes: > On Fri, Sep 29, 2023 at 4:24=E2=80=AFAM Kees Cook = wrote: >> >> Hi, >> >> This is the continuation of the work Eric started for handling >> "p_memsz > p_filesz" in arbitrary segments (rather than just the last, >> BSS, segment). I've added the suggested changes: >> >> - drop unused "elf_bss" variable >> - refactor load_elf_interp() to use elf_load() >> - refactor load_elf_library() to use elf_load() >> - report padzero() errors when PROT_WRITE is present >> - drop vm_brk() >> >> Thanks! >> >> -Kees >> >> v4: >> - refactor load_elf_library() too >> - don't refactor padzero(), just test in the only remaining caller >> - drop now-unused vm_brk() >> v3: https://lore.kernel.org/all/20230927033634.make.602-kees@kernel.org >> v2: https://lore.kernel.org/lkml/87sf71f123.fsf@email.froward.int.ebiede= rm.org >> v1: https://lore.kernel.org/lkml/87jzsemmsd.fsf_-_@email.froward.int.ebi= ederm.org >> >> Eric W. Biederman (1): >> binfmt_elf: Support segments with 0 filesz and misaligned starts >> >> Kees Cook (5): >> binfmt_elf: elf_bss no longer used by load_elf_binary() >> binfmt_elf: Use elf_load() for interpreter >> binfmt_elf: Use elf_load() for library >> binfmt_elf: Only report padzero() errors when PROT_WRITE >> mm: Remove unused vm_brk() >> >> fs/binfmt_elf.c | 214 ++++++++++++++++----------------------------- >> include/linux/mm.h | 3 +- >> mm/mmap.c | 6 -- >> mm/nommu.c | 5 -- >> 4 files changed, 76 insertions(+), 152 deletions(-) > > Sorry for taking so long to take a look at this. > While I didn't test PPC64 (I don't own PPC64 hardware, and I wasn't > the original reporter), I did manage to craft a reduced test case of: > > a.out: > > Program Headers: > Type Offset VirtAddr PhysAddr > FileSiz MemSiz Flags Align > PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040 > 0x00000000000001f8 0x00000000000001f8 R 0x8 > INTERP 0x0000000000000238 0x0000000000000238 0x0000000000000238 > 0x0000000000000020 0x0000000000000020 R 0x1 > [Requesting program interpreter: /home/pfalcato/musl/lib/libc.so] > LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000 > 0x0000000000000428 0x0000000000000428 R 0x1000 > LOAD 0x0000000000001000 0x0000000000001000 0x0000000000001000 > 0x00000000000000cd 0x00000000000000cd R E 0x1000 > LOAD 0x0000000000002000 0x0000000000002000 0x0000000000002000 > 0x0000000000000084 0x0000000000000084 R 0x1000 > LOAD 0x0000000000002e50 0x0000000000003e50 0x0000000000003e50 > 0x00000000000001c8 0x00000000000001c8 RW 0x1000 > DYNAMIC 0x0000000000002e50 0x0000000000003e50 0x0000000000003e50 > 0x0000000000000180 0x0000000000000180 RW 0x8 > GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 > 0x0000000000000000 0x0000000000000000 RW 0x10 > GNU_RELRO 0x0000000000002e50 0x0000000000003e50 0x0000000000003e50 > 0x00000000000001b0 0x00000000000001b0 R 0x1 > > /home/pfalcato/musl/lib/libc.so: > Program Headers: > Type Offset VirtAddr PhysAddr > FileSiz MemSiz Flags Align > PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040 > 0x0000000000000230 0x0000000000000230 R 0x8 > LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000 > 0x0000000000049d9c 0x0000000000049d9c R 0x1000 > LOAD 0x0000000000049da0 0x000000000004ada0 0x000000000004ada0 > 0x0000000000057d30 0x0000000000057d30 R E 0x1000 > LOAD 0x00000000000a1ad0 0x00000000000a3ad0 0x00000000000a3ad0 > 0x00000000000005f0 0x00000000000015f0 RW 0x1000 > LOAD 0x00000000000a20c0 0x00000000000a60c0 0x00000000000a60c0 > 0x0000000000000428 0x0000000000002f80 RW 0x1000 > DYNAMIC 0x00000000000a1f38 0x00000000000a3f38 0x00000000000a3f38 > 0x0000000000000110 0x0000000000000110 RW 0x8 > GNU_RELRO 0x00000000000a1ad0 0x00000000000a3ad0 0x00000000000a3ad0 > 0x00000000000005f0 0x0000000000002530 R 0x1 > GNU_EH_FRAME 0x0000000000049d10 0x0000000000049d10 0x0000000000049d10 > 0x0000000000000024 0x0000000000000024 R 0x4 > GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 > 0x0000000000000000 0x0000000000000000 RW 0x0 > NOTE 0x0000000000000270 0x0000000000000270 0x0000000000000270 > 0x0000000000000018 0x0000000000000018 R 0x4 > > Section to Segment mapping: > Segment Sections... > 00 > 01 .note.gnu.build-id .dynsym .gnu.hash .hash .dynstr .rela.dyn > .rela.plt .rodata .eh_frame_hdr .eh_frame > 02 .text .plt > 03 .data.rel.ro .dynamic .got .toc > 04 .data .got.plt .bss > 05 .dynamic > 06 .data.rel.ro .dynamic .got .toc > 07 .eh_frame_hdr > 08 > 09 .note.gnu.build-id > > > So on that end, you can take my > > Tested-by: Pedro Falcato > > Although this still doesn't address the other bug I found > (https://github.com/heatd/elf-bug-questionmark), where segments can > accidentally overwrite cleared BSS if we end up in a situation where > e.g we have the following segments: > > Program Headers: > Type Offset VirtAddr PhysAddr > FileSiz MemSiz Flags Align > LOAD 0x0000000000001000 0x0000000000400000 0x0000000000400000 > 0x0000000000000045 0x0000000000000045 R E 0x1000 > LOAD 0x0000000000002000 0x0000000000401000 0x0000000000401000 > 0x000000000000008c 0x000000000000008c R 0x1000 > LOAD 0x0000000000000000 0x0000000000402000 0x0000000000402000 > 0x0000000000000000 0x0000000000000801 RW 0x1000 > LOAD 0x0000000000002801 0x0000000000402801 0x0000000000402801 > 0x0000000000000007 0x0000000000000007 RW 0x1000 > NOTE 0x0000000000002068 0x0000000000401068 0x0000000000401068 > 0x0000000000000024 0x0000000000000024 0x4 > > Section to Segment mapping: > Segment Sections... > 00 .text > 01 .rodata .note.gnu.property .note.gnu.build-id > 02 .bss > 03 .data > 04 .note.gnu.build-id > > since the mmap of .data will end up happening over .bss. This is simply invalid userspace, doubly so with the alignment set to 0x1000. The best the kernel can do is have a pre-pass through the elf program headers (before the point of no-return) and if they describe overlapping segments or out of order segments, cause execve syscall to fail. Eric