Received: by 2002:a05:6a10:2726:0:0:0:0 with SMTP id ib38csp680178pxb; Tue, 5 Apr 2022 18:30:18 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwxsKmXX9iB144GB3iSW1ySL0uL6jnlzdRYUqdZ/06J5IGZVXsANM9rD3axkVBatNJjcSeE X-Received: by 2002:a17:906:a44c:b0:6e7:ed8b:5126 with SMTP id cb12-20020a170906a44c00b006e7ed8b5126mr6111464ejb.75.1649208618634; Tue, 05 Apr 2022 18:30:18 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1649208618; cv=none; d=google.com; s=arc-20160816; b=EaujVni2wSZpoyBrKqp3E7a9t1/Bq1E1clDPK2OPSyN4mwe2LtSLn9G2F86SBDpwmr RKcS/glkHxS97LLlshuYM6kZQyVbY8wQvR4jhxvgjrmhmzRMY3gI1W8c3iRq2rukE+6o LRfzHI5n4ueVEvbe7oI9zMjRalQbuoFYTYvYP4XWN54QKVTYWPhvjJPx1/Wek79dA4BQ ZzuqX888dYJQdrpPpXxAqRUqyx6D/0H/dqukloz8mn4jxhw3hoJ0OyVjd0KUcbXiNUX+ nt+0XiL2ZBnlnMIhWrZVdBSYoL3ZPnrB4Ki7meOC38pcJfd6tkQGejaMvsIqIJnYgUXB 80qw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=qUUNeg/EjcehFTJGkzNoLsuSyeU5hVbPprKwQNPlBwc=; b=VgiNEIQS8eXEv/W2EDorjm4eX+8Gvt5v7DsD4ZRel8uHisLSsc8oBrKEXl/ERCpA2H gifs25kLy51JqTSNEGbReuMPMF/HHXxSybkQaNRweZ2fglBlIKD3k7sKFM2yoLANm8vL n8YYqZpHGYQVp0rcZZ+oPvKgfgVMr+3uvmaraMw8SmdyQaowDOTS7vDML89noRdmm7Z0 jL7DDuvNpOFb9R3GJzMPFyIKBIATmFr8+65lkiRSDnmXIxPBsUgvsKVk9ZlqV5GYazKh p1k4n6YZnVAqCCHgMWVtej1b4IykFQFECYnyYNjMM2Gj0FpZuOsi9JmawYhjb1MwElPh rMBw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=mPcUt5Kw; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id de11-20020a1709069bcb00b006e7f65c37aasi4990842ejc.985.2022.04.05.18.29.53; Tue, 05 Apr 2022 18:30:18 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=mPcUt5Kw; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343924AbiDEJPo (ORCPT + 99 others); Tue, 5 Apr 2022 05:15:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34822 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239649AbiDEIUX (ORCPT ); Tue, 5 Apr 2022 04:20:23 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 38D542BD; Tue, 5 Apr 2022 01:18:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E6F7CB81B92; Tue, 5 Apr 2022 08:18:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 42A31C385A1; Tue, 5 Apr 2022 08:18:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649146692; bh=uKfwxnRdGV6bnGFbOE1aukn5+0ttKyN7SN8ugucYkHg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mPcUt5Kwlf0+jXKOLJNFGBBjdEkGZCT/x20LlO5VrrUCvx9gDIXjg5a7BlrEl9bIt +xX/ShMcm/6r2hwWbJEFs/Me8jRScEcmFSoHCUEEpy667WI528hT4LD6f9EZqEuxbY j9erU29yFKwx7F/kcHsJHdBIyXGuAawwkgbZLisg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Akira Kawata , kernel test robot , Kees Cook , Sasha Levin Subject: [PATCH 5.17 0855/1126] fs/binfmt_elf: Fix AT_PHDR for unusual ELF files Date: Tue, 5 Apr 2022 09:26:42 +0200 Message-Id: <20220405070432.640064274@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070407.513532867@linuxfoundation.org> References: <20220405070407.513532867@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Akira Kawata [ Upstream commit 0da1d5002745cdc721bc018b582a8a9704d56c42 ] BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197921 As pointed out in the discussion of buglink, we cannot calculate AT_PHDR as the sum of load_addr and exec->e_phoff. : The AT_PHDR of ELF auxiliary vectors should point to the memory address : of program header. But binfmt_elf.c calculates this address as follows: : : NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff); : : which is wrong since e_phoff is the file offset of program header and : load_addr is the memory base address from PT_LOAD entry. : : The ld.so uses AT_PHDR as the memory address of program header. In normal : case, since the e_phoff is usually 64 and in the first PT_LOAD region, it : is the correct program header address. : : But if the address of program header isn't equal to the first PT_LOAD : address + e_phoff (e.g. Put the program header in other non-consecutive : PT_LOAD region), ld.so will try to read program header from wrong address : then crash or use incorrect program header. This is because exec->e_phoff is the offset of PHDRs in the file and the address of PHDRs in the memory may differ from it. This patch fixes the bug by calculating the address of program headers from PT_LOADs directly. Signed-off-by: Akira Kawata Reported-by: kernel test robot Acked-by: Kees Cook Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220127124014.338760-2-akirakawata1@gmail.com Signed-off-by: Sasha Levin --- fs/binfmt_elf.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index d61543fbd652..af0965c10619 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -170,8 +170,8 @@ static int padzero(unsigned long elf_bss) static int create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, - unsigned long load_addr, unsigned long interp_load_addr, - unsigned long e_entry) + unsigned long interp_load_addr, + unsigned long e_entry, unsigned long phdr_addr) { struct mm_struct *mm = current->mm; unsigned long p = bprm->p; @@ -257,7 +257,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP); NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE); NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC); - NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff); + NEW_AUX_ENT(AT_PHDR, phdr_addr); NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr)); NEW_AUX_ENT(AT_PHNUM, exec->e_phnum); NEW_AUX_ENT(AT_BASE, interp_load_addr); @@ -823,7 +823,7 @@ static int parse_elf_properties(struct file *f, const struct elf_phdr *phdr, static int load_elf_binary(struct linux_binprm *bprm) { struct file *interpreter = NULL; /* to shut gcc up */ - unsigned long load_addr = 0, load_bias = 0; + unsigned long load_addr, load_bias = 0, phdr_addr = 0; int load_addr_set = 0; unsigned long error; struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; @@ -1180,6 +1180,17 @@ static int load_elf_binary(struct linux_binprm *bprm) reloc_func_desc = load_bias; } } + + /* + * Figure out which segment in the file contains the Program + * Header table, and map to the associated memory address. + */ + if (elf_ppnt->p_offset <= elf_ex->e_phoff && + elf_ex->e_phoff < elf_ppnt->p_offset + elf_ppnt->p_filesz) { + phdr_addr = elf_ex->e_phoff - elf_ppnt->p_offset + + elf_ppnt->p_vaddr; + } + k = elf_ppnt->p_vaddr; if ((elf_ppnt->p_flags & PF_X) && k < start_code) start_code = k; @@ -1215,6 +1226,7 @@ static int load_elf_binary(struct linux_binprm *bprm) } e_entry = elf_ex->e_entry + load_bias; + phdr_addr += load_bias; elf_bss += load_bias; elf_brk += load_bias; start_code += load_bias; @@ -1278,8 +1290,8 @@ static int load_elf_binary(struct linux_binprm *bprm) goto out; #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */ - retval = create_elf_tables(bprm, elf_ex, - load_addr, interp_load_addr, e_entry); + retval = create_elf_tables(bprm, elf_ex, interp_load_addr, + e_entry, phdr_addr); if (retval < 0) goto out; -- 2.34.1