Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
From:   Jann Horn <jannh@google.com>
Date:   Thu, 25 Mar 2021 20:23:52 +0100
Message-ID: <CAG48ez1wLkMCiyY+bWVonXZr2TjzhwKZjNZLD3Ads=Rds8YJSw@mail.gmail.com>
Subject: ARM FDPIC_FUNCPTRS personality flag handling looks broken
To:     Nicolas Pitre <nico@fluxnic.net>,
        Russell King - ARM Linux admin <linux@armlinux.org.uk>,
        Linux ARM <linux-arm-kernel@lists.infradead.org>,
        kernel list <linux-kernel@vger.kernel.org>
Cc:     Tavis Ormandy <taviso@google.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hi!

Tavis noticed that on ARM kernels with CONFIG_BINFMT_ELF_FDPIC, it
looks like the FDPIC_FUNCPTRS personality flag is not reset on
execve(). This would mean that if a process first executes an ELF
FDPIC binary (which forces the personality to PER_LINUX_FDPIC), and
then executes a non-FDPIC binary, the signal handling code
(setup_return()) will have bogus behavior (interpreting a normal
function pointer as an FDPIC function handle).

I think FDPIC_FUNCPTRS should probably either be reset on every
execve() or not be a personality flag at all (since AFAIU pretty much
the whole point of personality flags is that they control behavior
even across execve()).

(I don't have an FDPIC toolchain, so I'm writing this solely based on
having read the code, without having actually tested it.)