Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220131201716.5198-1-a3at.mail@gmail.com> <CAMe9rOqoPy6jsWrodnc41M4+b2onwkfbfr=pZ9qRWzOU2Uisgg@mail.gmail.com>
 <20220201061832.yatgwglxvi7ho4yr@carbon.azat> <CAMe9rOptn2vpY90yY3HuGmmMdj4Hpaba2PRhp4d033XBDgL_5w@mail.gmail.com>
 <20220201132807.m7xtogotjlg54pzl@carbon.azat>
In-Reply-To: <20220201132807.m7xtogotjlg54pzl@carbon.azat>
From:   "H.J. Lu" <hjl.tools@gmail.com>
Date:   Tue, 1 Feb 2022 05:39:57 -0800
Message-ID: <CAMe9rOpkHm7juB6f_z+osG28dGxe=4SSVN+8SHsxatVnwGQ5xA@mail.gmail.com>
Subject: Re: [PATCH] fs/binfmt_elf: use ELF_ET_DYN_BASE for PIE (ET_DYN with
 INTERP) binaries
To:     Azat Khuzhin <a3at.mail@gmail.com>
Cc:     LKML <linux-kernel@vger.kernel.org>,
        Chris Kennelly <ckennelly@google.com>,
        Al Viro <viro@zeniv.linux.org.uk>,
        Alexey Dobriyan <adobriyan@gmail.com>,
        Song Liu <songliubraving@fb.com>,
        David Rientjes <rientjes@google.com>,
        Ian Rogers <irogers@google.com>,
        Hugh Dickins <hughd@google.com>,
        Suren Baghdasaryan <surenb@google.com>,
        Sandeep Patil <sspatil@google.com>,
        Fangrui Song <maskray@google.com>,
        Nick Desaulniers <ndesaulniers@google.com>,
        "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
        Mike Kravetz <mike.kravetz@oracle.com>,
        Shuah Khan <shuah@kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Tue, Feb 1, 2022 at 5:28 AM Azat Khuzhin <a3at.mail@gmail.com> wrote:
>
> On Tue, Feb 01, 2022 at 05:15:38AM -0800, H.J. Lu wrote:
> > On Mon, Jan 31, 2022 at 10:18 PM Azat Khuzhin <a3at.mail@gmail.com> wrote:
> > >
> > > On Mon, Jan 31, 2022 at 01:30:38PM -0800, H.J. Lu wrote:
> > > > On Mon, Jan 31, 2022 at 12:17 PM Azat Khuzhin <a3at.mail@gmail.com> wrote:
> > > > >
> > > > > Since 9630f0d60fec ELF_ET_DYN_BASE is not used as a load_bias anymore
> > > > > and this breaks PIE binaries, since after this change data segment
> > > > > became too nearby the stack:
> > > > >
> > > > > Before 9630f0d60fec:
> > > > >
> > > > >     $ strace -febrk /tmp/test-stack |& head
> > > > >     brk(NULL)                               = 0x555555559000
> > > > >     $ /tmp/test-stack
> > > > >     bottom_of_stack = 0x7fffffffc5c0
> > > > >     recursion depth: 1 (stack diff: 32)
> > > > >     ...
> > > > >     recursion depth: 7690 (stack diff: 8365664)
> > > > >     Segmentation fault (core dumped)
> > > > >
> > > > > After 9630f0d60fec:
> > > > >
> > > > >     $ strace -ebrk /tmp/test-stack  |& head
> > > > >     brk(NULL)                               = 0x7ffff7fff000
> > > > >
> > > > >     $ /tmp/test-stack
> > > > >     bottom_of_stack = 0x7fffffffc640
> > > > >     recursion depth: 1 (stack diff: 32)
> > > > >     ...
> > > > >     recursion depth: 146 (stack diff: 157792)
> > > > >     Segmentation fault (core dumped)
> > > > >
> > > > > Found this during compiling with clang, that started to randomly
> > > > > SIGSEGV when it eats some heap.
> > > >
> > > > How do I reproduce it on x86-64?
> > >
> > > It fails for me for pretty big C++ unit, so I don't have a simple
> > > reproducer with clang, but the attached reproducer below should show the
> > > problem.
> >
> > The reproducer doesn't fail for me under 5.17-rc2 on Fedora 35/x86-64
> > with 32GB RAM.  Did you turn off PF_RANDOMIZE?
>
> Oh, yep, forgot to mention that I have kernel.randomize_va_space=0.

PIE with interpreter and PIE with alignment > ELF_MIN_ALIGN
should always be loaded from ELF_ET_DYN_BASE.  Otherwise,
either PIE is loaded at an address which is too low or isn't properly
aligned.

-- 
H.J.