* [PATCH] binfmt_flat: revert "binfmt_flat: don't offset the data start"
@ 2020-08-08 18:37 Max Filippov
2020-08-13 3:33 ` Greg Ungerer
0 siblings, 1 reply; 2+ messages in thread
From: Max Filippov @ 2020-08-08 18:37 UTC (permalink / raw)
To: linux-xtensa
Cc: Chris Zankel, linux-kernel, Christoph Hellwig, Greg Ungerer,
Max Filippov, stable
binfmt_flat loader uses the gap between text and data to store data
segment pointers for the libraries. Even in the absence of shared
libraries it stores at least one pointer to the executable's own data
segment. Text and data can go back to back in the flat binary image and
without offsetting data segment last few instructions in the text
segment may get corrupted by the data segment pointer.
Fix it by reverting commit a2357223c50a ("binfmt_flat: don't offset the
data start").
Cc: stable@vger.kernel.org
Fixes: a2357223c50a ("binfmt_flat: don't offset the data start")
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
---
fs/binfmt_flat.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index f2f9086ebe98..b9c658e0548e 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -576,7 +576,7 @@ static int load_flat_file(struct linux_binprm *bprm,
goto err;
}
- len = data_len + extra;
+ len = data_len + extra + MAX_SHARED_LIBS * sizeof(unsigned long);
len = PAGE_ALIGN(len);
realdatastart = vm_mmap(NULL, 0, len,
PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 0);
@@ -590,7 +590,9 @@ static int load_flat_file(struct linux_binprm *bprm,
vm_munmap(textpos, text_len);
goto err;
}
- datapos = ALIGN(realdatastart, FLAT_DATA_ALIGN);
+ datapos = ALIGN(realdatastart +
+ MAX_SHARED_LIBS * sizeof(unsigned long),
+ FLAT_DATA_ALIGN);
pr_debug("Allocated data+bss+stack (%u bytes): %lx\n",
data_len + bss_len + stack_len, datapos);
@@ -620,7 +622,7 @@ static int load_flat_file(struct linux_binprm *bprm,
memp_size = len;
} else {
- len = text_len + data_len + extra;
+ len = text_len + data_len + extra + MAX_SHARED_LIBS * sizeof(u32);
len = PAGE_ALIGN(len);
textpos = vm_mmap(NULL, 0, len,
PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE, 0);
@@ -635,7 +637,9 @@ static int load_flat_file(struct linux_binprm *bprm,
}
realdatastart = textpos + ntohl(hdr->data_start);
- datapos = ALIGN(realdatastart, FLAT_DATA_ALIGN);
+ datapos = ALIGN(realdatastart +
+ MAX_SHARED_LIBS * sizeof(u32),
+ FLAT_DATA_ALIGN);
reloc = (__be32 __user *)
(datapos + (ntohl(hdr->reloc_start) - text_len));
@@ -652,9 +656,8 @@ static int load_flat_file(struct linux_binprm *bprm,
(text_len + full_data
- sizeof(struct flat_hdr)),
0);
- if (datapos != realdatastart)
- memmove((void *)datapos, (void *)realdatastart,
- full_data);
+ memmove((void *) datapos, (void *) realdatastart,
+ full_data);
#else
/*
* This is used on MMU systems mainly for testing.
@@ -710,7 +713,8 @@ static int load_flat_file(struct linux_binprm *bprm,
if (IS_ERR_VALUE(result)) {
ret = result;
pr_err("Unable to read code+data+bss, errno %d\n", ret);
- vm_munmap(textpos, text_len + data_len + extra);
+ vm_munmap(textpos, text_len + data_len + extra +
+ MAX_SHARED_LIBS * sizeof(u32));
goto err;
}
}
--
2.20.1
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] binfmt_flat: revert "binfmt_flat: don't offset the data start"
2020-08-08 18:37 [PATCH] binfmt_flat: revert "binfmt_flat: don't offset the data start" Max Filippov
@ 2020-08-13 3:33 ` Greg Ungerer
0 siblings, 0 replies; 2+ messages in thread
From: Greg Ungerer @ 2020-08-13 3:33 UTC (permalink / raw)
To: Max Filippov, linux-xtensa
Cc: Chris Zankel, linux-kernel, Christoph Hellwig, stable
Hi Max,
On 9/8/20 4:37 am, Max Filippov wrote:
> binfmt_flat loader uses the gap between text and data to store data
> segment pointers for the libraries. Even in the absence of shared
> libraries it stores at least one pointer to the executable's own data
> segment. Text and data can go back to back in the flat binary image and
> without offsetting data segment last few instructions in the text
> segment may get corrupted by the data segment pointer.
Yep, your right, it does.
I will push this into the m68knommu git tree next week (once the merge
window is closed), and make sure it gets to Linus for rc series soon
after that.
Thanks
Greg
> Fix it by reverting commit a2357223c50a ("binfmt_flat: don't offset the
> data start").
>
> Cc: stable@vger.kernel.org
> Fixes: a2357223c50a ("binfmt_flat: don't offset the data start")
> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
> ---
> fs/binfmt_flat.c | 20 ++++++++++++--------
> 1 file changed, 12 insertions(+), 8 deletions(-)
>
> diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
> index f2f9086ebe98..b9c658e0548e 100644
> --- a/fs/binfmt_flat.c
> +++ b/fs/binfmt_flat.c
> @@ -576,7 +576,7 @@ static int load_flat_file(struct linux_binprm *bprm,
> goto err;
> }
>
> - len = data_len + extra;
> + len = data_len + extra + MAX_SHARED_LIBS * sizeof(unsigned long);
> len = PAGE_ALIGN(len);
> realdatastart = vm_mmap(NULL, 0, len,
> PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 0);
> @@ -590,7 +590,9 @@ static int load_flat_file(struct linux_binprm *bprm,
> vm_munmap(textpos, text_len);
> goto err;
> }
> - datapos = ALIGN(realdatastart, FLAT_DATA_ALIGN);
> + datapos = ALIGN(realdatastart +
> + MAX_SHARED_LIBS * sizeof(unsigned long),
> + FLAT_DATA_ALIGN);
>
> pr_debug("Allocated data+bss+stack (%u bytes): %lx\n",
> data_len + bss_len + stack_len, datapos);
> @@ -620,7 +622,7 @@ static int load_flat_file(struct linux_binprm *bprm,
> memp_size = len;
> } else {
>
> - len = text_len + data_len + extra;
> + len = text_len + data_len + extra + MAX_SHARED_LIBS * sizeof(u32);
> len = PAGE_ALIGN(len);
> textpos = vm_mmap(NULL, 0, len,
> PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE, 0);
> @@ -635,7 +637,9 @@ static int load_flat_file(struct linux_binprm *bprm,
> }
>
> realdatastart = textpos + ntohl(hdr->data_start);
> - datapos = ALIGN(realdatastart, FLAT_DATA_ALIGN);
> + datapos = ALIGN(realdatastart +
> + MAX_SHARED_LIBS * sizeof(u32),
> + FLAT_DATA_ALIGN);
>
> reloc = (__be32 __user *)
> (datapos + (ntohl(hdr->reloc_start) - text_len));
> @@ -652,9 +656,8 @@ static int load_flat_file(struct linux_binprm *bprm,
> (text_len + full_data
> - sizeof(struct flat_hdr)),
> 0);
> - if (datapos != realdatastart)
> - memmove((void *)datapos, (void *)realdatastart,
> - full_data);
> + memmove((void *) datapos, (void *) realdatastart,
> + full_data);
> #else
> /*
> * This is used on MMU systems mainly for testing.
> @@ -710,7 +713,8 @@ static int load_flat_file(struct linux_binprm *bprm,
> if (IS_ERR_VALUE(result)) {
> ret = result;
> pr_err("Unable to read code+data+bss, errno %d\n", ret);
> - vm_munmap(textpos, text_len + data_len + extra);
> + vm_munmap(textpos, text_len + data_len + extra +
> + MAX_SHARED_LIBS * sizeof(u32));
> goto err;
> }
> }
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-08-13 3:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-08-08 18:37 [PATCH] binfmt_flat: revert "binfmt_flat: don't offset the data start" Max Filippov
2020-08-13 3:33 ` Greg Ungerer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).