mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
binfmt_elf: Avoid total_mapping_size for ET_EXEC
Partially revert commit5f501d5556
("binfmt_elf: reintroduce using MAP_FIXED_NOREPLACE"), which applied the ET_DYN "total_mapping_size" logic also to ET_EXEC. At least ia64 has ET_EXEC PT_LOAD segments that are not virtual-address contiguous (but _are_ file-offset contiguous). This would result in a giant mapping attempting to cover the entire span, including the virtual address range hole, and well beyond the size of the ELF file itself, causing the kernel to refuse to load it. For example: $ readelf -lW /usr/bin/gcc ... Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz ... ... LOAD 0x000000 0x4000000000000000 0x4000000000000000 0x00b5a0 0x00b5a0 ... LOAD 0x00b5a0 0x600000000000b5a0 0x600000000000b5a0 0x0005ac 0x000710 ... ... ^^^^^^^^ ^^^^^^^^^^^^^^^^^^ ^^^^^^^^ ^^^^^^^^ File offset range : 0x000000-0x00bb4c 0x00bb4c bytes Virtual address range : 0x4000000000000000-0x600000000000bcb0 0x200000000000bcb0 bytes Remove the total_mapping_size logic for ET_EXEC, which reduces the ET_EXEC MAP_FIXED_NOREPLACE coverage to only the first PT_LOAD (better than nothing), and retains it for ET_DYN. Ironically, this is the reverse of the problem that originally caused problems with MAP_FIXED_NOREPLACE: overlapping PT_LOAD segments. Future work could restore full coverage if load_elf_binary() were to perform mappings in a separate phase from the loading (where it could resolve both overlaps and holes). Cc: Eric Biederman <ebiederm@xmission.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: linux-fsdevel@vger.kernel.org Cc: linux-mm@kvack.org Reported-by: matoro <matoro_bugzilla_kernel@matoro.tk> Fixes:5f501d5556
("binfmt_elf: reintroduce using MAP_FIXED_NOREPLACE") Link: https://lore.kernel.org/r/a3edd529-c42d-3b09-135c-7e98a15b150f@leemhuis.info Tested-by: matoro <matoro_mailinglist_kernel@matoro.tk> Link: https://lore.kernel.org/lkml/ce8af9c13bcea9230c7689f3c1e0e2cd@matoro.tk Tested-By: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> Link: https://lore.kernel.org/lkml/49182d0d-708b-4029-da5f-bc18603440a6@physik.fu-berlin.de Cc: stable@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org>
This commit is contained in:
parent
dfd42facf1
commit
439a846824
|
@ -1135,14 +1135,25 @@ static int load_elf_binary(struct linux_binprm *bprm)
|
||||||
* is then page aligned.
|
* is then page aligned.
|
||||||
*/
|
*/
|
||||||
load_bias = ELF_PAGESTART(load_bias - vaddr);
|
load_bias = ELF_PAGESTART(load_bias - vaddr);
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Calculate the entire size of the ELF mapping (total_size).
|
* Calculate the entire size of the ELF mapping
|
||||||
* (Note that load_addr_set is set to true later once the
|
* (total_size), used for the initial mapping,
|
||||||
* initial mapping is performed.)
|
* due to load_addr_set which is set to true later
|
||||||
*/
|
* once the initial mapping is performed.
|
||||||
if (!load_addr_set) {
|
*
|
||||||
|
* Note that this is only sensible when the LOAD
|
||||||
|
* segments are contiguous (or overlapping). If
|
||||||
|
* used for LOADs that are far apart, this would
|
||||||
|
* cause the holes between LOADs to be mapped,
|
||||||
|
* running the risk of having the mapping fail,
|
||||||
|
* as it would be larger than the ELF file itself.
|
||||||
|
*
|
||||||
|
* As a result, only ET_DYN does this, since
|
||||||
|
* some ET_EXEC (e.g. ia64) may have large virtual
|
||||||
|
* memory holes between LOADs.
|
||||||
|
*
|
||||||
|
*/
|
||||||
total_size = total_mapping_size(elf_phdata,
|
total_size = total_mapping_size(elf_phdata,
|
||||||
elf_ex->e_phnum);
|
elf_ex->e_phnum);
|
||||||
if (!total_size) {
|
if (!total_size) {
|
||||||
|
|
Loading…
Reference in a new issue