From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 28226C433EF for ; Tue, 8 Mar 2022 09:51:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Xpmis6+YQuX79x8Om+F2xXQStSkjpDj/LdtxgrHLdxk=; b=K2s2NEjs9bk/24 2hrN/oJSw10DmO6EVesSLMATnqfoyr5kUN8AojamE98n1q+vLH2+Y2Gx7rpZMfFRndzhbdb+bcKjp X4j7wQI2r49o66NzD+TZaywh8ixqPvqlQDF+/bGvaikAlBGNAOHa0qC2CMOJWq/ajXMjDu5cdWsco ukQGXgu8FOKBk/9MQPHKR3YDuhIGUiZhR604ebKobeLTwbCn4cJzp4qkpohOJeq9q/hQXFfy9e3Ni pu7aavSQY9mcK+8KKn4X0VCaN1b/1SqIrgrzU+nIuDVjOXAg3JdQOit4r1bHVFSu1hCS5RyjrTdoE 2+g9GaU6kTQXhKIK2YOQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nRWU0-003ccL-7A; Tue, 08 Mar 2022 09:50:22 +0000 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nRWPJ-003aTz-Jb for linux-arm-kernel@lists.infradead.org; Tue, 08 Mar 2022 09:45:31 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D55DB6120A; Tue, 8 Mar 2022 09:45:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 11416C340EC; Tue, 8 Mar 2022 09:45:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1646732728; bh=iotVYzC96pnctOSwfHjiP/LZc5bmukNkEwD4I7skqws=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=hYdsDQO19ZsfpxsJzU9IbHSkiCYxEI+46imI2pk0F8sGhdGj31bdBMnqmjwx+vjra 7evH2Jlya1+eNkgMkUj1VoQghXUaHHGnNgkMiRIaIseGpMQJ7krh5eDj4SNMsKpMfA W8Gy595ceZPJTZEkIHd345HRcRfAFCFrnFJ+lnjiOt9vOkAWx30FZ3LcPJ2jGrwXWJ lrzlUoW1L2S2w0OKnIM2GKML9B4ENo250KxUDepB5KWOpX9cveOx+zClbkgEEZ4MiZ ZsbEEEBRf86styeCwhwwtpSzMo1ljOZNkWSPJllDpSkoZ5lDgROB63v1PMShmJQyBZ Ayfh3exaIkkaA== Date: Tue, 8 Mar 2022 09:45:22 +0000 From: Will Deacon To: Kees Cook Cc: Mark Brown , Catalin Marinas , Szabolcs Nagy , Jeremy Linton , "H . J . Lu" , Yu-cheng Yu , Eric Biederman , linux-arch@vger.kernel.org, linux-arm-kernel@lists.infradead.org, libc-alpha@sourceware.org, Dave Martin Subject: Re: [PATCH v10 1/2] elf: Allow architectures to parse properties on the main executable Message-ID: <20220308094521.GA31063@willie-the-truck> References: <20220228130606.1070960-1-broonie@kernel.org> <20220228130606.1070960-2-broonie@kernel.org> <202203071551.DBABE01@keescook> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <202203071551.DBABE01@keescook> User-Agent: Mutt/1.10.1 (2018-07-13) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220308_014529_762604_E1FCA56D X-CRM114-Status: GOOD ( 35.29 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Mon, Mar 07, 2022 at 04:00:15PM -0800, Kees Cook wrote: > On Mon, Feb 28, 2022 at 01:06:05PM +0000, Mark Brown wrote: > > Currently the ELF code only attempts to parse properties on the image > > that will start execution, either the interpreter or for statically linked > > executables the main executable. The expectation is that any property > > handling for the main executable will be done by the interpreter. This is > > a bit inconsistent since we do map the executable and is causing problems > > for the arm64 BTI support when used in conjunction with systemd's use of > > seccomp to implement MemoryDenyWriteExecute which stops the dynamic linker > > adjusting the permissions of executable segments. > > > > Allow architectures to handle properties for both the dynamic linker and > > main executable, adjusting arch_parse_elf_properties() to have a new > > flag is_interp flag as with arch_elf_adjust_prot() and calling it for > > both the main executable and any intepreter. > > > > The user of this code, arm64, is adapted to ensure that there is no > > functional change. > > > > Signed-off-by: Mark Brown > > Tested-by: Jeremy Linton > > Reviewed-by: Dave Martin > > Reviewed-by: Catalin Marinas > > --- > > arch/arm64/include/asm/elf.h | 3 ++- > > fs/binfmt_elf.c | 32 +++++++++++++++++++++++--------- > > include/linux/elf.h | 4 +++- > > 3 files changed, 28 insertions(+), 11 deletions(-) > > > > diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h > > index 97932fbf973d..5cc002376abe 100644 > > --- a/arch/arm64/include/asm/elf.h > > +++ b/arch/arm64/include/asm/elf.h > > @@ -259,6 +259,7 @@ struct arch_elf_state { > > > > static inline int arch_parse_elf_property(u32 type, const void *data, > > size_t datasz, bool compat, > > + bool has_interp, bool is_interp, > > struct arch_elf_state *arch) > > Adding more and more args to a functions like this gives me the sense > that some kind of argument structure is needed. > > Once I get enough unit testing written in here, I'm hoping to refactor > a bunch of this. To the future! :) > > > @@ -828,6 +832,7 @@ static int load_elf_binary(struct linux_binprm *bprm) > > unsigned long error; > > struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; > > struct elf_phdr *elf_property_phdata = NULL; > > + struct elf_phdr *interp_elf_property_phdata = NULL; > > unsigned long elf_bss, elf_brk; > > int bss_prot = 0; > > int retval, i; > > @@ -865,6 +870,9 @@ static int load_elf_binary(struct linux_binprm *bprm) > > for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) { > > char *elf_interpreter; > > > > + if (interpreter && elf_property_phdata) > > + break; > > + > > This is not okay. This introduces a memory resource leak for malicious > ELF files with multiple INTERP headers. > > > if (elf_ppnt->p_type == PT_GNU_PROPERTY) { > > elf_property_phdata = elf_ppnt; > > continue; > > @@ -919,7 +927,7 @@ static int load_elf_binary(struct linux_binprm *bprm) > > if (retval < 0) > > goto out_free_dentry; > > > > - break; > > + continue; > > Because of this. > > As a fix, I'd expect the PT_INTERP test to be updated: > > if (interpreter || elf_ppnt->p_type != PT_INTERP) > continue; Thanks, Kees. I'll drop this branch from -next until it's been resolved. Will _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel