2023-06-09 11:48:04

by Nikolay Borisov

Subject: [PATCH v2 4/4] x86: Disable laoding 32bit processes if ia32_disabled is true

In addition to disabling 32bit syscall interface let's also disable the
ability to load 32bit compat processes.

Signed-off-by: Nikolay Borisov <[email protected]>
---
arch/x86/include/asm/elf.h | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index 18fd06f7936a..0fa49388ff16 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -148,9 +148,16 @@ do { \
#define elf_check_arch(x) \
((x)->e_machine == EM_X86_64)

+#ifdef CONFIG_IA32_EMULATION
+extern bool ia32_disabled;
#define compat_elf_check_arch(x) \
- (elf_check_arch_ia32(x) || \
+ ((elf_check_arch_ia32(x) && !ia32_disabled) || \
(IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64))
+#else
+#define compat_elf_check_arch(x) \
+ (elf_check_arch_ia32(x) || \
+ (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64))
+#endif

static inline void elf_common_init(struct thread_struct *t,
struct pt_regs *regs, const u16 ds)
--
2.34.1

2023-06-09 15:33:05

by Thomas Gleixner

Subject: Re: [PATCH v2 4/4] x86: Disable laoding 32bit processes if ia32_disabled is true

On Fri, Jun 09 2023 at 14:13, Nikolay Borisov wrote:
> diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
> index 18fd06f7936a..0fa49388ff16 100644
> --- a/arch/x86/include/asm/elf.h
> +++ b/arch/x86/include/asm/elf.h
> @@ -148,9 +148,16 @@ do { \
> #define elf_check_arch(x) \
> ((x)->e_machine == EM_X86_64)
>
> +#ifdef CONFIG_IA32_EMULATION
> +extern bool ia32_disabled;
> #define compat_elf_check_arch(x) \

1) Your keyboard clearly has a broken newline key.

2) Why is there still a duplicated declaration?

3) This #ifdeffery is not needed if this is done right.

Thanks,

tglx

2023-06-09 17:31:05

by Brian Gerst

Subject: Re: [PATCH v2 4/4] x86: Disable laoding 32bit processes if ia32_disabled is true

On Fri, Jun 9, 2023 at 8:07 AM Nikolay Borisov <[email protected]> wrote:
>
> In addition to disabling 32bit syscall interface let's also disable the
> ability to load 32bit compat processes.
>
> Signed-off-by: Nikolay Borisov <[email protected]>

This patch needs to come beforethe patch that disables 32-bit
syscalls. It makes no sense to be able to load a 32-bit executable
that cannot make syscalls.

Brian Gerst