From: Andrew Morton <akpm@linux-foundation.org>
To: Kees Cook <keescook@chromium.org>
Cc: "Magnus Groß" <magnus.gross@rwth-aachen.de>,
"Alexander Viro" <viro@zeniv.linux.org.uk>,
"Eric Biederman" <ebiederm@xmission.com>,
linux-fsdevel@vger.kernel.org, linux-mm@kvack.org,
linux-hardening@vger.kernel.org,
"Alexey Dobriyan" <adobriyan@gmail.com>
Subject: Re: [PATCH] elf: Relax assumptions about vaddr ordering
Date: Tue, 1 Feb 2022 14:44:48 -0800 [thread overview]
Message-ID: <20220201144448.8b3b322dc58dc3ec71f72246@linux-foundation.org> (raw)
In-Reply-To: <202201262230.E16DF58B@keescook>
On Wed, 26 Jan 2022 22:31:42 -0800 Kees Cook <keescook@chromium.org> wrote:
> On Wed, Jan 26, 2022 at 08:50:15AM -0800, Kees Cook wrote:
> > On Wed, Jan 26, 2022 at 05:25:20PM +0100, Magnus Groß wrote:
> > > From ff4dde97e82727727bda711f2367c05663498b24 Mon Sep 17 00:00:00 2001
> > > From: =?UTF-8?q?Magnus=20Gro=C3=9F?= <magnus.gross@rwth-aachen.de>
> > > Date: Wed, 26 Jan 2022 16:35:07 +0100
> > > Subject: [PATCH] elf: Relax assumptions about vaddr ordering
> > > MIME-Version: 1.0
> > > Content-Type: text/plain; charset=UTF-8
> > > Content-Transfer-Encoding: 8bit
> > >
> > > Commit 5f501d555653 ("binfmt_elf: reintroduce using
> > > MAP_FIXED_NOREPLACE") introduced a regression, where the kernel now
> > > assumes that PT_LOAD segments are ordered by vaddr in load_elf_binary().
> > >
> > > Specifically consider an ELF binary with the following PT_LOAD segments:
> > >
> > > Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
> > > LOAD 0x000000 0x08000000 0x08000000 0x474585 0x474585 R E 0x1000
> > > LOAD 0x475000 0x08475000 0x08475000 0x090a4 0xc6c10 RW 0x1000
> > > LOAD 0x47f000 0x00010000 0x00010000 0x00000 0x7ff0000 0x1000
> > >
> > > Note how the last segment is actually the first segment and vice versa.
> > >
> > > Since total_mapping_size() only computes the difference between the
> > > first and the last segment in the order that they appear, it will return
> > > a size of 0 in this case, thus causing load_elf_binary() to fail, which
> > > did not happen before that change.
> > >
> > > Strictly speaking total_mapping_size() made that assumption already
> > > before that patch, but the issue did not appear because the old
> > > load_addr_set guards never allowed this call to total_mapping_size().
> > >
> > > Instead of fixing this by reverting to the old load_addr_set logic, we
> > > fix this by comparing the correct first and last segments in
> > > total_mapping_size().
> >
> > Ah, nice. Yeah, this is good.
> >
> > > Signed-off-by: Magnus Groß <magnus.gross@rwth-aachen.de>
> >
> > Fixes: 5f501d555653 ("binfmt_elf: reintroduce using MAP_FIXED_NOREPLACE")
> > Cc: stable@vger.kernel.org
> > Acked-by: Kees Cook <keescook@chromium.org>
>
> Andrew, can you pick this up too?
>
It conflicts significantly with Alexey's "ELF: fix overflow in total
mapping size calculation".
prev parent reply other threads:[~2022-02-01 22:44 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-26 16:25 [PATCH] elf: Relax assumptions about vaddr ordering Magnus Groß
2022-01-26 16:50 ` Kees Cook
2022-01-27 6:31 ` Kees Cook
2022-01-28 8:26 ` Magnus Groß
2022-01-28 20:04 ` Kees Cook
2022-01-28 22:30 ` Kees Cook
2022-01-29 7:53 ` Alexey Dobriyan
2022-01-29 13:28 ` Magnus Groß
2022-02-01 22:48 ` Andrew Morton
2022-02-02 1:07 ` Kees Cook
2022-02-02 15:15 ` Alexey Dobriyan
2022-02-02 15:44 ` Magnus Groß
2022-02-01 22:44 ` Andrew Morton [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220201144448.8b3b322dc58dc3ec71f72246@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=adobriyan@gmail.com \
--cc=ebiederm@xmission.com \
--cc=keescook@chromium.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=magnus.gross@rwth-aachen.de \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.