linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings
@ 2021-09-28 12:56 Chen Jingwen
  2021-09-28 22:21 ` Andrew Morton
  2021-10-04 20:00 ` Kees Cook
  0 siblings, 2 replies; 6+ messages in thread
From: Chen Jingwen @ 2021-09-28 12:56 UTC (permalink / raw)
  To: Chen Jingwen, linux-fsdevel, linux-kernel
  Cc: Alexander Viro, Michal Hocko, Andrei Vagin, Khalid Aziz,
	Michael Ellerman, Andrew Morton

In commit b212921b13bd ("elf: don't use MAP_FIXED_NOREPLACE for elf executable mappings")
we still leave MAP_FIXED_NOREPLACE in place for load_elf_interp.
Unfortunately, this will cause kernel to fail to start with

[    2.384321] 1 (init): Uhuuh, elf segment at 00003ffff7ffd000 requested but the memory is mapped already
[    2.386240] Failed to execute /init (error -17)

The reason is that the elf interpreter (ld.so) has overlapping segments.

readelf -l ld-2.31.so
Program Headers:
  Type           Offset             VirtAddr           PhysAddr
                 FileSiz            MemSiz              Flags  Align
  LOAD           0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x000000000002c94c 0x000000000002c94c  R E    0x10000
  LOAD           0x000000000002dae0 0x000000000003dae0 0x000000000003dae0
                 0x00000000000021e8 0x0000000000002320  RW     0x10000
  LOAD           0x000000000002fe00 0x000000000003fe00 0x000000000003fe00
                 0x00000000000011ac 0x0000000000001328  RW     0x10000

The reason for this problem is the same as described in
commit ad55eac74f20 ("elf: enforce MAP_FIXED on overlaying elf segments").
Not only executable binaries, elf interpreters (e.g. ld.so) can have
overlapping elf segments, so we better drop MAP_FIXED_NOREPLACE and go
back to MAP_FIXED in load_elf_interp.

Fixes: 4ed28639519c ("fs, elf: drop MAP_FIXED usage from elf_map")
Cc: <stable@vger.kernel.org> # v4.19
Signed-off-by: Chen Jingwen <chenjingwen6@huawei.com>
---
 fs/binfmt_elf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 69d900a8473d..a813b70f594e 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -630,7 +630,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
 
 			vaddr = eppnt->p_vaddr;
 			if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
-				elf_type |= MAP_FIXED_NOREPLACE;
+				elf_type |= MAP_FIXED;
 			else if (no_base && interp_elf_ex->e_type == ET_DYN)
 				load_addr = -vaddr;
 
-- 
2.12.3


^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2021-10-18  6:51 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-09-28 12:56 [PATCH] elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings Chen Jingwen
2021-09-28 22:21 ` Andrew Morton
2021-10-04 20:00 ` Kees Cook
2021-10-05 23:12   ` Andrew Morton
2021-10-05 23:27     ` Kees Cook
2021-10-18  6:51   ` ChenJingwen

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).