From patchwork Tue Sep 26 14:42:44 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Eric W. Biederman" X-Patchwork-Id: 144924 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:cae8:0:b0:403:3b70:6f57 with SMTP id r8csp1970091vqu; Tue, 26 Sep 2023 07:46:19 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGqM74QStTZ0iG81oo08zFMNYwLxhz8DpW2zZ6WnEhBBKk/JwxNgYx7f0FdCQdsT44jdb5U X-Received: by 2002:a17:90a:f510:b0:274:99e8:1670 with SMTP id cs16-20020a17090af51000b0027499e81670mr9313437pjb.43.1695739579391; Tue, 26 Sep 2023 07:46:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1695739579; cv=none; d=google.com; s=arc-20160816; b=Ll++JsJxsa/qvuT5zcHP0eqzik1cFbWAsSS5WXScugjifyjmHcPLs8B5xegp2eoMA0 tXmT7cX7Shi2uoB8NBkgV7n6h+akRZxsb51I9Lt4MYxkB97wvMIegHrhGidigAbeSIIG Qe0h7StczCEJB7ozESoRGllf8MNltvPweCjmFKJ+jQB+X4Z3C+Dca/xE9o7aFgZZKFn9 uRSBMK1UKQnpF6t7hsHyDUCi/1+OrmZpF0rOabSY7atMbnlsTSQ/MLsZ9wbavqGdZNdt AMTL3HR7jHlxaJKJWs+smTbTGKwKdptbIzJmiOc9dqNz6MXc0W7BKrYN7p1+ZsUZzDS9 OGCQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:subject:content-transfer-encoding:mime-version :user-agent:message-id:in-reply-to:date:references:cc:to:from; bh=DnU3hYENf7E2v5nSt7SDDaDEtlHXuIdQmmdrE1ev20c=; fh=tnhLACzhBoc317NUEtFeswcWNX43ghXl6i0FoQpt4tM=; b=LfhIZfVYEhXqfTYVVbdHe6/PhO55GLoqKEpXnbEOA1MCJaVSCQyuSHGIza6HKq+XcP p0KOnk3dWK0BvS5smPIosnhFkpz6ZGF3oZ7KZ0WhiZaXQ6lV+yFccJ4Nnu7bv2tQ0/H3 ED/V9Rtn7djzRHZX8tB0oKEv5LhfnCxf0J3kyZFPptSYswe0mZzm5M0td0eaJdE+iHCp TzbRMlTGhHvTSxADdJSJCVeCpYS7NkB8Yh63xzKrczl4tl+e8FIa/qlfhXT6K5qiHmIh pRXaEyHRB7vADDEEHlIy4bbhCACyDbXqxXZBoealMDwylkjv0qANaMO3bwHr5d8gAoT2 ifCQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=xmission.com Received: from agentk.vger.email (agentk.vger.email. [23.128.96.32]) by mx.google.com with ESMTPS id t6-20020a17090a024600b0026390b4a4e0si14828533pje.124.2023.09.26.07.46.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 Sep 2023 07:46:19 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) client-ip=23.128.96.32; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=xmission.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by agentk.vger.email (Postfix) with ESMTP id 70E9F80FCE2C; Tue, 26 Sep 2023 07:43:30 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at agentk.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234911AbjIZOnU convert rfc822-to-8bit (ORCPT + 28 others); Tue, 26 Sep 2023 10:43:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56852 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234955AbjIZOnR (ORCPT ); Tue, 26 Sep 2023 10:43:17 -0400 Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D7974120; Tue, 26 Sep 2023 07:43:10 -0700 (PDT) Received: from in02.mta.xmission.com ([166.70.13.52]:34354) by out02.mta.xmission.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1ql9HI-001UMK-Fa; Tue, 26 Sep 2023 08:43:08 -0600 Received: from ip68-227-168-167.om.om.cox.net ([68.227.168.167]:53274 helo=email.froward.int.ebiederm.org.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1ql9HH-00AmvZ-6o; Tue, 26 Sep 2023 08:43:08 -0600 From: "Eric W. Biederman" To: Dan Carpenter Cc: oe-kbuild@lists.linux.dev, Sebastian Ott , lkp@intel.com, oe-kbuild-all@lists.linux.dev, Thomas =?utf-8?q?Wei=C3=9Fsch?= =?utf-8?q?uh?= , Alexander Viro , Christian Brauner , Kees Cook , Mark Brown , Willy Tarreau , linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org References: <60c7fdeb-da32-4d21-9e34-368050224d6c@kadam.mountain> Date: Tue, 26 Sep 2023 09:42:44 -0500 In-Reply-To: <60c7fdeb-da32-4d21-9e34-368050224d6c@kadam.mountain> (Dan Carpenter's message of "Tue, 26 Sep 2023 16:49:57 +0300") Message-ID: <87sf71f123.fsf@email.froward.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) MIME-Version: 1.0 X-XM-SPF: eid=1ql9HH-00AmvZ-6o;;;mid=<87sf71f123.fsf@email.froward.int.ebiederm.org>;;;hst=in02.mta.xmission.com;;;ip=68.227.168.167;;;frm=ebiederm@xmission.com;;;spf=pass X-XM-AID: U2FsdGVkX1/Hj+tqfYmK0zrPxO+Sjh4Gz9DbfrD3sFA= X-SA-Exim-Connect-IP: 68.227.168.167 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on agentk.vger.email X-Spam-Level: X-Spam-Status: No, score=-0.8 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-DCC: XMission; sa07 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ;Dan Carpenter X-Spam-Relay-Country: X-Spam-Timing: total 670 ms - load_scoreonly_sql: 0.03 (0.0%), signal_user_changed: 10 (1.5%), b_tie_ro: 9 (1.4%), parse: 1.21 (0.2%), extract_message_metadata: 21 (3.2%), get_uri_detail_list: 3.6 (0.5%), tests_pri_-2000: 23 (3.4%), tests_pri_-1000: 2.7 (0.4%), tests_pri_-950: 1.32 (0.2%), tests_pri_-900: 1.05 (0.2%), tests_pri_-200: 0.87 (0.1%), tests_pri_-100: 17 (2.6%), tests_pri_-90: 108 (16.2%), check_bayes: 97 (14.5%), b_tokenize: 13 (2.0%), b_tok_get_all: 38 (5.7%), b_comp_prob: 3.0 (0.4%), b_tok_touch_all: 39 (5.8%), b_finish: 0.89 (0.1%), tests_pri_0: 469 (70.0%), check_dkim_signature: 0.68 (0.1%), check_dkim_adsp: 7 (1.0%), poll_dns_idle: 0.56 (0.1%), tests_pri_10: 2.1 (0.3%), tests_pri_500: 8 (1.2%), rewrite_mail: 0.00 (0.0%) Subject: [PATCH v2] binfmt_elf: Support segments with 0 filesz and misaligned starts X-SA-Exim-Version: 4.2.1 (built Sat, 08 Feb 2020 21:53:50 +0000) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (agentk.vger.email [0.0.0.0]); Tue, 26 Sep 2023 07:43:30 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1778111825090063659 X-GMAIL-MSGID: 1778111825090063659 Implement a helper elf_load that wraps elf_map and performs all of the necessary work to ensure that when "memsz > filesz" the bytes described by "memsz > filesz" are zeroed. Link: https://lkml.kernel.org/r/20230914-bss-alloc-v1-1-78de67d2c6dd@weissschuh.net Reported-by: Sebastian Ott Reported-by: Thomas Weißschuh Signed-off-by: "Eric W. Biederman" --- fs/binfmt_elf.c | 111 +++++++++++++++++++++--------------------------- 1 file changed, 48 insertions(+), 63 deletions(-) Dan Carpenter writes: > smatch warnings: > fs/binfmt_elf.c:431 elf_load() error: uninitialized symbol 'map_addr'. That was embarrassing. I have added an initialization of map_error in the p_filesz == 0 case. I am a bit surprised this worked without map_error being set in testing, but it looks like any "value < TASK_SIZE" would work. So I guess odds are about 50/50 that any random stack value would not cause load_elf_binary to fail. Thanks for pointing that out. Eric diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 7b3d2d491407..2a615f476e44 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -110,25 +110,6 @@ static struct linux_binfmt elf_format = { #define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE)) -static int set_brk(unsigned long start, unsigned long end, int prot) -{ - start = ELF_PAGEALIGN(start); - end = ELF_PAGEALIGN(end); - if (end > start) { - /* - * Map the last of the bss segment. - * If the header is requesting these pages to be - * executable, honour that (ppc32 needs this). - */ - int error = vm_brk_flags(start, end - start, - prot & PROT_EXEC ? VM_EXEC : 0); - if (error) - return error; - } - current->mm->start_brk = current->mm->brk = end; - return 0; -} - /* We need to explicitly zero any fractional pages after the data section (i.e. bss). This would contain the junk from the file that should not @@ -406,6 +387,51 @@ static unsigned long elf_map(struct file *filep, unsigned long addr, return(map_addr); } +static unsigned long elf_load(struct file *filep, unsigned long addr, + const struct elf_phdr *eppnt, int prot, int type, + unsigned long total_size) +{ + unsigned long zero_start, zero_end; + unsigned long map_addr; + + if (eppnt->p_filesz) { + map_addr = elf_map(filep, addr, eppnt, prot, type, total_size); + if (BAD_ADDR(map_addr)) + return map_addr; + if (eppnt->p_memsz > eppnt->p_filesz) { + zero_start = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) + + eppnt->p_filesz; + zero_end = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) + + eppnt->p_memsz; + + /* Zero the end of the last mapped page */ + padzero(zero_start); + } + } else { + map_addr = zero_start = ELF_PAGESTART(addr); + zero_end = zero_start + ELF_PAGEOFFSET(eppnt->p_vaddr) + + eppnt->p_memsz; + } + if (eppnt->p_memsz > eppnt->p_filesz) { + /* + * Map the last of the segment. + * If the header is requesting these pages to be + * executable, honour that (ppc32 needs this). + */ + int error; + + zero_start = ELF_PAGEALIGN(zero_start); + zero_end = ELF_PAGEALIGN(zero_end); + + error = vm_brk_flags(zero_start, zero_end - zero_start, + prot & PROT_EXEC ? VM_EXEC : 0); + if (error) + map_addr = error; + } + return map_addr; +} + + static unsigned long total_mapping_size(const struct elf_phdr *phdr, int nr) { elf_addr_t min_addr = -1; @@ -829,7 +855,6 @@ static int load_elf_binary(struct linux_binprm *bprm) struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; struct elf_phdr *elf_property_phdata = NULL; unsigned long elf_bss, elf_brk; - int bss_prot = 0; int retval, i; unsigned long elf_entry; unsigned long e_entry; @@ -1040,33 +1065,6 @@ static int load_elf_binary(struct linux_binprm *bprm) if (elf_ppnt->p_type != PT_LOAD) continue; - if (unlikely (elf_brk > elf_bss)) { - unsigned long nbyte; - - /* There was a PT_LOAD segment with p_memsz > p_filesz - before this one. Map anonymous pages, if needed, - and clear the area. */ - retval = set_brk(elf_bss + load_bias, - elf_brk + load_bias, - bss_prot); - if (retval) - goto out_free_dentry; - nbyte = ELF_PAGEOFFSET(elf_bss); - if (nbyte) { - nbyte = ELF_MIN_ALIGN - nbyte; - if (nbyte > elf_brk - elf_bss) - nbyte = elf_brk - elf_bss; - if (clear_user((void __user *)elf_bss + - load_bias, nbyte)) { - /* - * This bss-zeroing can fail if the ELF - * file specifies odd protections. So - * we don't check the return value - */ - } - } - } - elf_prot = make_prot(elf_ppnt->p_flags, &arch_state, !!interpreter, false); @@ -1162,7 +1160,7 @@ static int load_elf_binary(struct linux_binprm *bprm) } } - error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, + error = elf_load(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags, total_size); if (BAD_ADDR(error)) { retval = IS_ERR_VALUE(error) ? @@ -1217,10 +1215,8 @@ static int load_elf_binary(struct linux_binprm *bprm) if (end_data < k) end_data = k; k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz; - if (k > elf_brk) { - bss_prot = elf_prot; + if (k > elf_brk) elf_brk = k; - } } e_entry = elf_ex->e_entry + load_bias; @@ -1232,18 +1228,7 @@ static int load_elf_binary(struct linux_binprm *bprm) start_data += load_bias; end_data += load_bias; - /* Calling set_brk effectively mmaps the pages that we need - * for the bss and break sections. We must do this before - * mapping in the interpreter, to make sure it doesn't wind - * up getting placed where the bss needs to go. - */ - retval = set_brk(elf_bss, elf_brk, bss_prot); - if (retval) - goto out_free_dentry; - if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) { - retval = -EFAULT; /* Nobody gets to see this, but.. */ - goto out_free_dentry; - } + current->mm->start_brk = current->mm->brk = ELF_PAGEALIGN(elf_brk); if (interpreter) { elf_entry = load_elf_interp(interp_elf_ex,