Since 9630f0d60fec ELF_ET_DYN_BASE is not used as a load_bias anymore
and this breaks PIE binaries, since after this change data segment
became too nearby the stack:
Before 9630f0d60fec:
$ strace -febrk /tmp/test-stack |& head
brk(NULL) = 0x555555559000
$ /tmp/test-stack
bottom_of_stack = 0x7fffffffc5c0
recursion depth: 1 (stack diff: 32)
...
recursion depth: 7690 (stack diff: 8365664)
Segmentation fault (core dumped)
After 9630f0d60fec:
$ strace -ebrk /tmp/test-stack |& head
brk(NULL) = 0x7ffff7fff000
$ /tmp/test-stack
bottom_of_stack = 0x7fffffffc640
recursion depth: 1 (stack diff: 32)
...
recursion depth: 146 (stack diff: 157792)
Segmentation fault (core dumped)
Found this during compiling with clang, that started to randomly
SIGSEGV when it eats some heap.
Reproducer:
#include <stdio.h>
#include <stddef.h>
#include <stdlib.h>
static int depth = 0;
static void* bottom_of_stack;
int inner()
{
char buffer[1024];
ptrdiff_t diff;
int ret;
++depth;
diff = bottom_of_stack - __builtin_frame_address(0);
fprintf(stderr,
"recursion depth: %i (stack diff: %zu)\n",
depth, (size_t)diff);
for (size_t i = 0; i < 1024; ++i)
ret += buffer[i];
ret += inner();
return ret;
}
int main()
{
for (size_t size = 0; size < 128<<20; size += 16<<10)
malloc(16<<10);
bottom_of_stack = __builtin_frame_address(0);
fprintf(stderr, "bottom_of_stack = %p\n", bottom_of_stack);
inner();
}
Fixes: 9630f0d60fec ("fs/binfmt_elf: use PT_LOAD p_align values for static PIE")
Signed-off-by: Azat Khuzhin <[email protected]>
Cc: Chris Kennelly <[email protected]>
Cc: Al Viro <[email protected]>
Cc: Alexey Dobriyan <[email protected]>
Cc: Song Liu <[email protected]>
Cc: David Rientjes <[email protected]>
Cc: Ian Rogers <[email protected]>
Cc: Hugh Dickins <[email protected]>
Cc: Suren Baghdasaryan <[email protected]>
Cc: Sandeep Patil <[email protected]>
Cc: Fangrui Song <[email protected]>
Cc: Nick Desaulniers <[email protected]>
Cc: Kirill A. Shutemov <[email protected]>
Cc: Mike Kravetz <[email protected]>
Cc: Shuah Khan <[email protected]>
Cc: H.J. Lu <[email protected]>
---
fs/binfmt_elf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 605017eb9349..9e11e6f13e83 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1117,7 +1117,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
* without MAP_FIXED nor MAP_FIXED_NOREPLACE).
*/
alignment = maximum_alignment(elf_phdata, elf_ex->e_phnum);
- if (alignment > ELF_MIN_ALIGN) {
+ if (interpreter || alignment > ELF_MIN_ALIGN) {
load_bias = ELF_ET_DYN_BASE;
if (current->flags & PF_RANDOMIZE)
load_bias += arch_mmap_rnd();
--
2.35.1
On Mon, Jan 31, 2022 at 12:17 PM Azat Khuzhin <[email protected]> wrote:
>
> Since 9630f0d60fec ELF_ET_DYN_BASE is not used as a load_bias anymore
> and this breaks PIE binaries, since after this change data segment
> became too nearby the stack:
>
> Before 9630f0d60fec:
>
> $ strace -febrk /tmp/test-stack |& head
> brk(NULL) = 0x555555559000
> $ /tmp/test-stack
> bottom_of_stack = 0x7fffffffc5c0
> recursion depth: 1 (stack diff: 32)
> ...
> recursion depth: 7690 (stack diff: 8365664)
> Segmentation fault (core dumped)
>
> After 9630f0d60fec:
>
> $ strace -ebrk /tmp/test-stack |& head
> brk(NULL) = 0x7ffff7fff000
>
> $ /tmp/test-stack
> bottom_of_stack = 0x7fffffffc640
> recursion depth: 1 (stack diff: 32)
> ...
> recursion depth: 146 (stack diff: 157792)
> Segmentation fault (core dumped)
>
> Found this during compiling with clang, that started to randomly
> SIGSEGV when it eats some heap.
How do I reproduce it on x86-64?
> Reproducer:
>
> #include <stdio.h>
> #include <stddef.h>
> #include <stdlib.h>
>
> static int depth = 0;
> static void* bottom_of_stack;
>
> int inner()
> {
> char buffer[1024];
> ptrdiff_t diff;
> int ret;
>
> ++depth;
> diff = bottom_of_stack - __builtin_frame_address(0);
>
> fprintf(stderr,
> "recursion depth: %i (stack diff: %zu)\n",
> depth, (size_t)diff);
>
> for (size_t i = 0; i < 1024; ++i)
> ret += buffer[i];
>
> ret += inner();
>
> return ret;
> }
>
> int main()
> {
> for (size_t size = 0; size < 128<<20; size += 16<<10)
> malloc(16<<10);
>
> bottom_of_stack = __builtin_frame_address(0);
> fprintf(stderr, "bottom_of_stack = %p\n", bottom_of_stack);
> inner();
> }
>
> Fixes: 9630f0d60fec ("fs/binfmt_elf: use PT_LOAD p_align values for static PIE")
> Signed-off-by: Azat Khuzhin <[email protected]>
> Cc: Chris Kennelly <[email protected]>
> Cc: Al Viro <[email protected]>
> Cc: Alexey Dobriyan <[email protected]>
> Cc: Song Liu <[email protected]>
> Cc: David Rientjes <[email protected]>
> Cc: Ian Rogers <[email protected]>
> Cc: Hugh Dickins <[email protected]>
> Cc: Suren Baghdasaryan <[email protected]>
> Cc: Sandeep Patil <[email protected]>
> Cc: Fangrui Song <[email protected]>
> Cc: Nick Desaulniers <[email protected]>
> Cc: Kirill A. Shutemov <[email protected]>
> Cc: Mike Kravetz <[email protected]>
> Cc: Shuah Khan <[email protected]>
> Cc: H.J. Lu <[email protected]>
> ---
> fs/binfmt_elf.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index 605017eb9349..9e11e6f13e83 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -1117,7 +1117,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
> * without MAP_FIXED nor MAP_FIXED_NOREPLACE).
> */
> alignment = maximum_alignment(elf_phdata, elf_ex->e_phnum);
> - if (alignment > ELF_MIN_ALIGN) {
> + if (interpreter || alignment > ELF_MIN_ALIGN) {
> load_bias = ELF_ET_DYN_BASE;
> if (current->flags & PF_RANDOMIZE)
> load_bias += arch_mmap_rnd();
> --
> 2.35.1
>
--
H.J.
On Tue, Feb 1, 2022 at 5:28 AM Azat Khuzhin <[email protected]> wrote:
>
> On Tue, Feb 01, 2022 at 05:15:38AM -0800, H.J. Lu wrote:
> > On Mon, Jan 31, 2022 at 10:18 PM Azat Khuzhin <[email protected]> wrote:
> > >
> > > On Mon, Jan 31, 2022 at 01:30:38PM -0800, H.J. Lu wrote:
> > > > On Mon, Jan 31, 2022 at 12:17 PM Azat Khuzhin <[email protected]> wrote:
> > > > >
> > > > > Since 9630f0d60fec ELF_ET_DYN_BASE is not used as a load_bias anymore
> > > > > and this breaks PIE binaries, since after this change data segment
> > > > > became too nearby the stack:
> > > > >
> > > > > Before 9630f0d60fec:
> > > > >
> > > > > $ strace -febrk /tmp/test-stack |& head
> > > > > brk(NULL) = 0x555555559000
> > > > > $ /tmp/test-stack
> > > > > bottom_of_stack = 0x7fffffffc5c0
> > > > > recursion depth: 1 (stack diff: 32)
> > > > > ...
> > > > > recursion depth: 7690 (stack diff: 8365664)
> > > > > Segmentation fault (core dumped)
> > > > >
> > > > > After 9630f0d60fec:
> > > > >
> > > > > $ strace -ebrk /tmp/test-stack |& head
> > > > > brk(NULL) = 0x7ffff7fff000
> > > > >
> > > > > $ /tmp/test-stack
> > > > > bottom_of_stack = 0x7fffffffc640
> > > > > recursion depth: 1 (stack diff: 32)
> > > > > ...
> > > > > recursion depth: 146 (stack diff: 157792)
> > > > > Segmentation fault (core dumped)
> > > > >
> > > > > Found this during compiling with clang, that started to randomly
> > > > > SIGSEGV when it eats some heap.
> > > >
> > > > How do I reproduce it on x86-64?
> > >
> > > It fails for me for pretty big C++ unit, so I don't have a simple
> > > reproducer with clang, but the attached reproducer below should show the
> > > problem.
> >
> > The reproducer doesn't fail for me under 5.17-rc2 on Fedora 35/x86-64
> > with 32GB RAM. Did you turn off PF_RANDOMIZE?
>
> Oh, yep, forgot to mention that I have kernel.randomize_va_space=0.
PIE with interpreter and PIE with alignment > ELF_MIN_ALIGN
should always be loaded from ELF_ET_DYN_BASE. Otherwise,
either PIE is loaded at an address which is too low or isn't properly
aligned.
--
H.J.
On Tue, Feb 01, 2022 at 05:15:38AM -0800, H.J. Lu wrote:
> On Mon, Jan 31, 2022 at 10:18 PM Azat Khuzhin <[email protected]> wrote:
> >
> > On Mon, Jan 31, 2022 at 01:30:38PM -0800, H.J. Lu wrote:
> > > On Mon, Jan 31, 2022 at 12:17 PM Azat Khuzhin <[email protected]> wrote:
> > > >
> > > > Since 9630f0d60fec ELF_ET_DYN_BASE is not used as a load_bias anymore
> > > > and this breaks PIE binaries, since after this change data segment
> > > > became too nearby the stack:
> > > >
> > > > Before 9630f0d60fec:
> > > >
> > > > $ strace -febrk /tmp/test-stack |& head
> > > > brk(NULL) = 0x555555559000
> > > > $ /tmp/test-stack
> > > > bottom_of_stack = 0x7fffffffc5c0
> > > > recursion depth: 1 (stack diff: 32)
> > > > ...
> > > > recursion depth: 7690 (stack diff: 8365664)
> > > > Segmentation fault (core dumped)
> > > >
> > > > After 9630f0d60fec:
> > > >
> > > > $ strace -ebrk /tmp/test-stack |& head
> > > > brk(NULL) = 0x7ffff7fff000
> > > >
> > > > $ /tmp/test-stack
> > > > bottom_of_stack = 0x7fffffffc640
> > > > recursion depth: 1 (stack diff: 32)
> > > > ...
> > > > recursion depth: 146 (stack diff: 157792)
> > > > Segmentation fault (core dumped)
> > > >
> > > > Found this during compiling with clang, that started to randomly
> > > > SIGSEGV when it eats some heap.
> > >
> > > How do I reproduce it on x86-64?
> >
> > It fails for me for pretty big C++ unit, so I don't have a simple
> > reproducer with clang, but the attached reproducer below should show the
> > problem.
>
> The reproducer doesn't fail for me under 5.17-rc2 on Fedora 35/x86-64
> with 32GB RAM. Did you turn off PF_RANDOMIZE?
Oh, yep, forgot to mention that I have kernel.randomize_va_space=0.
On Mon, Jan 31, 2022 at 01:30:38PM -0800, H.J. Lu wrote:
> On Mon, Jan 31, 2022 at 12:17 PM Azat Khuzhin <[email protected]> wrote:
> >
> > Since 9630f0d60fec ELF_ET_DYN_BASE is not used as a load_bias anymore
> > and this breaks PIE binaries, since after this change data segment
> > became too nearby the stack:
> >
> > Before 9630f0d60fec:
> >
> > $ strace -febrk /tmp/test-stack |& head
> > brk(NULL) = 0x555555559000
> > $ /tmp/test-stack
> > bottom_of_stack = 0x7fffffffc5c0
> > recursion depth: 1 (stack diff: 32)
> > ...
> > recursion depth: 7690 (stack diff: 8365664)
> > Segmentation fault (core dumped)
> >
> > After 9630f0d60fec:
> >
> > $ strace -ebrk /tmp/test-stack |& head
> > brk(NULL) = 0x7ffff7fff000
> >
> > $ /tmp/test-stack
> > bottom_of_stack = 0x7fffffffc640
> > recursion depth: 1 (stack diff: 32)
> > ...
> > recursion depth: 146 (stack diff: 157792)
> > Segmentation fault (core dumped)
> >
> > Found this during compiling with clang, that started to randomly
> > SIGSEGV when it eats some heap.
>
> How do I reproduce it on x86-64?
It fails for me for pretty big C++ unit, so I don't have a simple
reproducer with clang, but the attached reproducer below should show the
problem.
> > Reproducer:
> >
> > #include <stdio.h>
> > #include <stddef.h>
> > #include <stdlib.h>
> >
> > static int depth = 0;
> > static void* bottom_of_stack;
> >
> > int inner()
> > {
> > char buffer[1024];
> > ptrdiff_t diff;
> > int ret;
> >
> > ++depth;
> > diff = bottom_of_stack - __builtin_frame_address(0);
> >
> > fprintf(stderr,
> > "recursion depth: %i (stack diff: %zu)\n",
> > depth, (size_t)diff);
> >
> > for (size_t i = 0; i < 1024; ++i)
> > ret += buffer[i];
> >
> > ret += inner();
> >
> > return ret;
> > }
> >
> > int main()
> > {
> > for (size_t size = 0; size < 128<<20; size += 16<<10)
> > malloc(16<<10);
> >
> > bottom_of_stack = __builtin_frame_address(0);
> > fprintf(stderr, "bottom_of_stack = %p\n", bottom_of_stack);
> > inner();
> > }
On Mon, Jan 31, 2022 at 10:18 PM Azat Khuzhin <[email protected]> wrote:
>
> On Mon, Jan 31, 2022 at 01:30:38PM -0800, H.J. Lu wrote:
> > On Mon, Jan 31, 2022 at 12:17 PM Azat Khuzhin <[email protected]> wrote:
> > >
> > > Since 9630f0d60fec ELF_ET_DYN_BASE is not used as a load_bias anymore
> > > and this breaks PIE binaries, since after this change data segment
> > > became too nearby the stack:
> > >
> > > Before 9630f0d60fec:
> > >
> > > $ strace -febrk /tmp/test-stack |& head
> > > brk(NULL) = 0x555555559000
> > > $ /tmp/test-stack
> > > bottom_of_stack = 0x7fffffffc5c0
> > > recursion depth: 1 (stack diff: 32)
> > > ...
> > > recursion depth: 7690 (stack diff: 8365664)
> > > Segmentation fault (core dumped)
> > >
> > > After 9630f0d60fec:
> > >
> > > $ strace -ebrk /tmp/test-stack |& head
> > > brk(NULL) = 0x7ffff7fff000
> > >
> > > $ /tmp/test-stack
> > > bottom_of_stack = 0x7fffffffc640
> > > recursion depth: 1 (stack diff: 32)
> > > ...
> > > recursion depth: 146 (stack diff: 157792)
> > > Segmentation fault (core dumped)
> > >
> > > Found this during compiling with clang, that started to randomly
> > > SIGSEGV when it eats some heap.
> >
> > How do I reproduce it on x86-64?
>
> It fails for me for pretty big C++ unit, so I don't have a simple
> reproducer with clang, but the attached reproducer below should show the
> problem.
The reproducer doesn't fail for me under 5.17-rc2 on Fedora 35/x86-64
with 32GB RAM. Did you turn off PF_RANDOMIZE?
> > > Reproducer:
> > >
> > > #include <stdio.h>
> > > #include <stddef.h>
> > > #include <stdlib.h>
> > >
> > > static int depth = 0;
> > > static void* bottom_of_stack;
> > >
> > > int inner()
> > > {
> > > char buffer[1024];
> > > ptrdiff_t diff;
> > > int ret;
> > >
> > > ++depth;
> > > diff = bottom_of_stack - __builtin_frame_address(0);
> > >
> > > fprintf(stderr,
> > > "recursion depth: %i (stack diff: %zu)\n",
> > > depth, (size_t)diff);
> > >
> > > for (size_t i = 0; i < 1024; ++i)
> > > ret += buffer[i];
> > >
> > > ret += inner();
> > >
> > > return ret;
> > > }
> > >
> > > int main()
> > > {
> > > for (size_t size = 0; size < 128<<20; size += 16<<10)
> > > malloc(16<<10);
> > >
> > > bottom_of_stack = __builtin_frame_address(0);
> > > fprintf(stderr, "bottom_of_stack = %p\n", bottom_of_stack);
> > > inner();
> > > }
--
H.J.
On Tue, Feb 01, 2022 at 05:39:57AM -0800, H.J. Lu wrote:
> On Tue, Feb 1, 2022 at 5:28 AM Azat Khuzhin <[email protected]> wrote:
> >
> > On Tue, Feb 01, 2022 at 05:15:38AM -0800, H.J. Lu wrote:
> > > On Mon, Jan 31, 2022 at 10:18 PM Azat Khuzhin <[email protected]> wrote:
> > > >
> > > > On Mon, Jan 31, 2022 at 01:30:38PM -0800, H.J. Lu wrote:
> > > > > On Mon, Jan 31, 2022 at 12:17 PM Azat Khuzhin <[email protected]> wrote:
> > > > > >
> > > > > > Since 9630f0d60fec ELF_ET_DYN_BASE is not used as a load_bias anymore
> > > > > > and this breaks PIE binaries, since after this change data segment
> > > > > > became too nearby the stack:
> > > > > >
> > > > > > Before 9630f0d60fec:
> > > > > >
> > > > > > $ strace -febrk /tmp/test-stack |& head
> > > > > > brk(NULL) = 0x555555559000
> > > > > > $ /tmp/test-stack
> > > > > > bottom_of_stack = 0x7fffffffc5c0
> > > > > > recursion depth: 1 (stack diff: 32)
> > > > > > ...
> > > > > > recursion depth: 7690 (stack diff: 8365664)
> > > > > > Segmentation fault (core dumped)
> > > > > >
> > > > > > After 9630f0d60fec:
> > > > > >
> > > > > > $ strace -ebrk /tmp/test-stack |& head
> > > > > > brk(NULL) = 0x7ffff7fff000
> > > > > >
> > > > > > $ /tmp/test-stack
> > > > > > bottom_of_stack = 0x7fffffffc640
> > > > > > recursion depth: 1 (stack diff: 32)
> > > > > > ...
> > > > > > recursion depth: 146 (stack diff: 157792)
> > > > > > Segmentation fault (core dumped)
> > > > > >
> > > > > > Found this during compiling with clang, that started to randomly
> > > > > > SIGSEGV when it eats some heap.
> > > > >
> > > > > How do I reproduce it on x86-64?
> > > >
> > > > It fails for me for pretty big C++ unit, so I don't have a simple
> > > > reproducer with clang, but the attached reproducer below should show the
> > > > problem.
> > >
> > > The reproducer doesn't fail for me under 5.17-rc2 on Fedora 35/x86-64
> > > with 32GB RAM. Did you turn off PF_RANDOMIZE?
> >
> > Oh, yep, forgot to mention that I have kernel.randomize_va_space=0.
>
> PIE with interpreter and PIE with alignment > ELF_MIN_ALIGN
> should always be loaded from ELF_ET_DYN_BASE. Otherwise,
> either PIE is loaded at an address which is too low or isn't properly
> aligned.
So, this is what this patch does, right?
Any news on this patch?