From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E4D9E7F154 for ; Fri, 29 Sep 2023 11:58:33 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D7EDB8D008F; Fri, 29 Sep 2023 07:58:32 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D2FD88D0023; Fri, 29 Sep 2023 07:58:32 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C1DC68D008F; Fri, 29 Sep 2023 07:58:32 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id B36178D0023 for ; Fri, 29 Sep 2023 07:58:32 -0400 (EDT) Received: from smtpin24.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 5BCEA41311 for ; Fri, 29 Sep 2023 11:58:32 +0000 (UTC) X-FDA: 81289487664.24.5A39A63 Received: from mail-ua1-f50.google.com (mail-ua1-f50.google.com [209.85.222.50]) by imf17.hostedemail.com (Postfix) with ESMTP id 96CAD40022 for ; Fri, 29 Sep 2023 11:58:30 +0000 (UTC) Authentication-Results: imf17.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b="U/cwE9yK"; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf17.hostedemail.com: domain of pedro.falcato@gmail.com designates 209.85.222.50 as permitted sender) smtp.mailfrom=pedro.falcato@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1695988710; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=BGtvKe2G8zhEWEUoqeoOHZOQEydFRztgt+R9qFXT7kA=; b=TzwroTbtZuQKNDOgMl1VlzGyh7q9bqcGrsX6yyEL01mIMhmPlnZvHhZJ55/gxGdMXZpucx 2uCacjbDF5QNiScSxadk5BmI1VEEYGXSH1qTNerO/fZdmujrcO405N6iJAfwntIXWQsv4k k3TtwqTRMjrw82GwB3Roo/Tf0mNVDIw= ARC-Authentication-Results: i=1; imf17.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b="U/cwE9yK"; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf17.hostedemail.com: domain of pedro.falcato@gmail.com designates 209.85.222.50 as permitted sender) smtp.mailfrom=pedro.falcato@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1695988710; a=rsa-sha256; cv=none; b=jqZvij3AdgzxtmP1shZjGvAEraaL+M5INFeeYI3IW5yaGDV1CaW1/+toUqLSMZe7W3whUI try5ldTZ8ho5DHprvBR8M2MFrs/hfTI6UDmgYJFCLbDrY54WR2l2r+ZcCnXwBPe2CfAdjs Lp5B8eIHd5yniGxIcq1lQB0ihsf8axM= Received: by mail-ua1-f50.google.com with SMTP id a1e0cc1a2514c-7abbe1067d1so4256328241.0 for ; Fri, 29 Sep 2023 04:58:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1695988709; x=1696593509; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=BGtvKe2G8zhEWEUoqeoOHZOQEydFRztgt+R9qFXT7kA=; b=U/cwE9yK9vrCOD/URkQZc8P0IAZ1lu1o1DErWMzwErIbHg5q0u9JQ+oM0iK03S+moI mRbw/iLsgjCdRsa6wcC3ZWqZbUBFY7+lRcuqPBGdjREc37zNvWUU59gII5MQ/qYnqtiZ wycT59zm8/peZp1fOxYUmtJViW9+2/UVnyfTF1SCR3/DN2LyQ1G5CAEzIcmeioMonuWt EH42cvDtrXtojSj6g0aYXke+nPHzaJtpBFf4T9MFSAedVMj9UwRSDGAXsmXsD0hLcDFx sSEuA1IR+lTO+JATqRipfiYlBuSAfWrB4xgbx3oxRnr52imMNVFIzStGzNIResXCfgqJ zczw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695988709; x=1696593509; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=BGtvKe2G8zhEWEUoqeoOHZOQEydFRztgt+R9qFXT7kA=; b=HREQFdML+M4FK9QvwYopFDqOc1HiMl2AbzTRZKvtqD6moZrWx0DaFgBOY4IMZFsv2C w7P3bIkTAEgttkZA44BL9Qgcw66TZcbGeJEoGyU1cQtTYuTZf2Sx+N5Rnw+IE+YYoK87 M5qwrq+YMc3T8SjwgJqmGjd/2y4Fy7KzZkF3vybFbahuTlj6DuWUwMu3CxMQeH8Jq/Nf T5YmDO3j7POexhEK1LIPNxotizXIy50ksk0Bimxhmi2gkMq+eKsFMQJKQPDl4ehs8uWf ru0JlpQUJ0a4pdPCG2cyzvfwy0eN2OyS3U1YrFzURt2hfF/HH92cwEC47VhHc09Kzftz isOw== X-Gm-Message-State: AOJu0YyHFIE1u0Gb+YoAfoPL2+TDCH8blnfW/km4SgLnhDx7U9uQOAG7 Gdvw8XmJWpN8TQYQhJAJaJEqvypIyPC7gnKdOo8= X-Google-Smtp-Source: AGHT+IGMMN6s4OUwobMuA4Eoln5lK/Dv0G+T3lg6T4TSgvSyTkPusHq5nf34rqmXYh4plgnMzGUopqnDq7aGYRrUioY= X-Received: by 2002:a67:e9ca:0:b0:44d:4dd6:796b with SMTP id q10-20020a67e9ca000000b0044d4dd6796bmr3819884vso.15.1695988709517; Fri, 29 Sep 2023 04:58:29 -0700 (PDT) MIME-Version: 1.0 References: <20230929031716.it.155-kees@kernel.org> In-Reply-To: <20230929031716.it.155-kees@kernel.org> From: Pedro Falcato Date: Fri, 29 Sep 2023 12:58:18 +0100 Message-ID: Subject: Re: [PATCH v4 0/6] binfmt_elf: Support segments with 0 filesz and misaligned starts To: Kees Cook Cc: Eric Biederman , Sebastian Ott , =?UTF-8?Q?Thomas_Wei=C3=9Fschuh?= , Al Viro , Christian Brauner , Andrew Morton , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspam-User: X-Stat-Signature: 5ef9xzkyjpa83soqj1p4jkpuxg6untr4 X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 96CAD40022 X-HE-Tag: 1695988710-761073 X-HE-Meta: U2FsdGVkX1/kT6gCUNqPzB3RPIFP7HOG3wpBnTSSbFjv2GR/6OVS9z84kuLBl4Hx2iUdiyIPx902Az9yFuy8gzHh9JhKpCwvCg04oGgPbD4wE9Zc8S4l3AqIYWVNyEUEJTAvrob/BI7k8Jk7x0lsl/AH4EDTcONmryRW/WSubq50/Zsc6V06EJviyYQ2Swk8ppSCGCUZKiqiX+H/+ZaLjIxJ6clsuhcDMuPNFSTbQhxGfgO7SGiVUlCRi50bydgyOPoYeiWx8THvx5TnlUrz0fvWu4soEBDdzUple/Hy++fZpgg5AXhGQXDFn3YG7/LFwyEnUddijMFzb+5pyE/j5s//y/YMU0OL9nQoDhZfu/31Hps8GUZS+edagcxpG36wRtbL1kU3tyXVGa8ixE9VQ3p5MGwKceTeA7gks8pCohyp3pJzuUfDWwefmas1XFe9WigmIU2m7nu4tNhR+t0QsnXXws5Xtv93h6ApKNzwPjNBUqUo9zRTGVfUHxcGJCmSiajFOndEwG7ku5Ltlf2YkJGSapXWh7hvuqg0d+ukENDw1BbZg90PdBMgTysqM1COgibhcSr50uUgZ2HXzmSbwXYGvyf+lYdvigFh9H2NVYQrVC9oTdA4Y1uJHqtyRKx2ohmceL1VT57mvWV1/Yj7VwcCJI8tku1Larkdji9d7czjiAulTomJu0kyj+jTBP19dMXqjSKHGBPzyoDbizQrwuSZYex9b/YkywNI+P6vR0ajxW2vYMklx/HTnTGufOjxncmx8c5p/pWF1TENKBAkcJiyz3V+M5m9Cr9K3EH3EESegL2KL0zqD+8/0zMpW86IZoaswWPgY3ssDB3lIDYUC0yFWtvzKyjVo0nTe/K07sIjTgZrfu0LglVs6lOouOJrLRA1CmwQlrV2pF+Hi2Fab1V48EcDhZA5d4RTRGE2XaiPSdLQdnukZQFHFVLkqMn00KW7Qgg8UZFX90dOfE4 uwGKT4YJ NGpg65neWdVuMd5hoesuq0C2e66wcVnjPh8vCZTmTnm7Ex5YgWIFMAR8W+79BQqqNKbSto1jtVC3vGxALqcFoV1iuXUYt6IDTbb5LnJABYYdASW8DHnpOptAfPS4zv+BVmgRK7DvQg/2xngMvUKnGig5PEdPVb5/d7rcZJdFcIrqisPFfgp7vbIjH7eREeZY92+5iiVjRVBgcFX8lYJAUYBJkNz6Hu0+5E8KxQjY/F43VCV/+CFkRoX7zpqCh4QHZfs4AGD1alQ+hoqDU9MD1Ygfw33/2piWec9eUS79IH3HUbDwQAtUtFNIZw9XgIYJuaTCK/NAe37Uk8nNyPrjCMgRLBdl+b0+Y6UHgtQ2oy4vS8mJsunihJ7mk7tG7YO3Ve0q/u3BS4DllKll36DScwEdI2154Iahd1JPAP1p2QQveTEODggrghrJomTotI7sRYzNbPFIfgGQaci2NhZpRCoVL2PaITXZWeLLsHVlelmxt6PhjQHhhAFbkxwoP4m9Hi+iEb2ENBYlwSIDwbyZu737fAEbqoIsjz/4xUyx0/UkNeRxhLkZIgi/9wyn7JoGCpQyUfrCvGoiGAzBVqK8q1ueVxMJZkjed2I7Cq90DrmiRh4sXYg32PHVUDQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Sep 29, 2023 at 4:24=E2=80=AFAM Kees Cook w= rote: > > Hi, > > This is the continuation of the work Eric started for handling > "p_memsz > p_filesz" in arbitrary segments (rather than just the last, > BSS, segment). I've added the suggested changes: > > - drop unused "elf_bss" variable > - refactor load_elf_interp() to use elf_load() > - refactor load_elf_library() to use elf_load() > - report padzero() errors when PROT_WRITE is present > - drop vm_brk() > > Thanks! > > -Kees > > v4: > - refactor load_elf_library() too > - don't refactor padzero(), just test in the only remaining caller > - drop now-unused vm_brk() > v3: https://lore.kernel.org/all/20230927033634.make.602-kees@kernel.org > v2: https://lore.kernel.org/lkml/87sf71f123.fsf@email.froward.int.ebieder= m.org > v1: https://lore.kernel.org/lkml/87jzsemmsd.fsf_-_@email.froward.int.ebie= derm.org > > Eric W. Biederman (1): > binfmt_elf: Support segments with 0 filesz and misaligned starts > > Kees Cook (5): > binfmt_elf: elf_bss no longer used by load_elf_binary() > binfmt_elf: Use elf_load() for interpreter > binfmt_elf: Use elf_load() for library > binfmt_elf: Only report padzero() errors when PROT_WRITE > mm: Remove unused vm_brk() > > fs/binfmt_elf.c | 214 ++++++++++++++++----------------------------- > include/linux/mm.h | 3 +- > mm/mmap.c | 6 -- > mm/nommu.c | 5 -- > 4 files changed, 76 insertions(+), 152 deletions(-) Sorry for taking so long to take a look at this. While I didn't test PPC64 (I don't own PPC64 hardware, and I wasn't the original reporter), I did manage to craft a reduced test case of: a.out: Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040 0x00000000000001f8 0x00000000000001f8 R 0x8 INTERP 0x0000000000000238 0x0000000000000238 0x0000000000000238 0x0000000000000020 0x0000000000000020 R 0x1 [Requesting program interpreter: /home/pfalcato/musl/lib/libc.so] LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000428 0x0000000000000428 R 0x1000 LOAD 0x0000000000001000 0x0000000000001000 0x0000000000001000 0x00000000000000cd 0x00000000000000cd R E 0x1000 LOAD 0x0000000000002000 0x0000000000002000 0x0000000000002000 0x0000000000000084 0x0000000000000084 R 0x1000 LOAD 0x0000000000002e50 0x0000000000003e50 0x0000000000003e50 0x00000000000001c8 0x00000000000001c8 RW 0x1000 DYNAMIC 0x0000000000002e50 0x0000000000003e50 0x0000000000003e50 0x0000000000000180 0x0000000000000180 RW 0x8 GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RW 0x10 GNU_RELRO 0x0000000000002e50 0x0000000000003e50 0x0000000000003e50 0x00000000000001b0 0x00000000000001b0 R 0x1 /home/pfalcato/musl/lib/libc.so: Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040 0x0000000000000230 0x0000000000000230 R 0x8 LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000049d9c 0x0000000000049d9c R 0x1000 LOAD 0x0000000000049da0 0x000000000004ada0 0x000000000004ada0 0x0000000000057d30 0x0000000000057d30 R E 0x1000 LOAD 0x00000000000a1ad0 0x00000000000a3ad0 0x00000000000a3ad0 0x00000000000005f0 0x00000000000015f0 RW 0x1000 LOAD 0x00000000000a20c0 0x00000000000a60c0 0x00000000000a60c0 0x0000000000000428 0x0000000000002f80 RW 0x1000 DYNAMIC 0x00000000000a1f38 0x00000000000a3f38 0x00000000000a3f38 0x0000000000000110 0x0000000000000110 RW 0x8 GNU_RELRO 0x00000000000a1ad0 0x00000000000a3ad0 0x00000000000a3ad0 0x00000000000005f0 0x0000000000002530 R 0x1 GNU_EH_FRAME 0x0000000000049d10 0x0000000000049d10 0x0000000000049d10 0x0000000000000024 0x0000000000000024 R 0x4 GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RW 0x0 NOTE 0x0000000000000270 0x0000000000000270 0x0000000000000270 0x0000000000000018 0x0000000000000018 R 0x4 Section to Segment mapping: Segment Sections... 00 01 .note.gnu.build-id .dynsym .gnu.hash .hash .dynstr .rela.dyn .rela.plt .rodata .eh_frame_hdr .eh_frame 02 .text .plt 03 .data.rel.ro .dynamic .got .toc 04 .data .got.plt .bss 05 .dynamic 06 .data.rel.ro .dynamic .got .toc 07 .eh_frame_hdr 08 09 .note.gnu.build-id So on that end, you can take my Tested-by: Pedro Falcato Although this still doesn't address the other bug I found (https://github.com/heatd/elf-bug-questionmark), where segments can accidentally overwrite cleared BSS if we end up in a situation where e.g we have the following segments: Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000001000 0x0000000000400000 0x0000000000400000 0x0000000000000045 0x0000000000000045 R E 0x1000 LOAD 0x0000000000002000 0x0000000000401000 0x0000000000401000 0x000000000000008c 0x000000000000008c R 0x1000 LOAD 0x0000000000000000 0x0000000000402000 0x0000000000402000 0x0000000000000000 0x0000000000000801 RW 0x1000 LOAD 0x0000000000002801 0x0000000000402801 0x0000000000402801 0x0000000000000007 0x0000000000000007 RW 0x1000 NOTE 0x0000000000002068 0x0000000000401068 0x0000000000401068 0x0000000000000024 0x0000000000000024 0x4 Section to Segment mapping: Segment Sections... 00 .text 01 .rodata .note.gnu.property .note.gnu.build-id 02 .bss 03 .data 04 .note.gnu.build-id since the mmap of .data will end up happening over .bss. --=20 Pedro