Received-SPF: pass (google.com: domain of linux-kernel+bounces-33196-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Precedence: bulk
MIME-Version: 1.0
References: <c7209e19-89c4-446a-b364-83100e30cc00@exia.io>
In-Reply-To: <c7209e19-89c4-446a-b364-83100e30cc00@exia.io>
From: Pedro Falcato <pedro.falcato@gmail.com>
Date: Mon, 22 Jan 2024 14:54:52 +0000
Message-ID: <CAKbZUD2=W0Ng=rFVDn3UwSxtGQ5c13tRwkpqm54pPCJO0BraWA@mail.gmail.com>
Subject: Re: Recent-ish changes in binfmt_elf made my program segfault
To: Jan Bujak <j@exia.io>
Cc: ebiederm@xmission.com, keescook@chromium.org, linux-mm@kvack.org, 
	linux-kernel@vger.kernel.org, viro@zeniv.linux.org.uk, brauner@kernel.org, 
	linux-fsdevel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Jan 22, 2024 at 12:16=E2=80=AFPM Jan Bujak <j@exia.io> wrote:
>
> Hi.
>
> I recently updated my kernel and one of my programs started segfaulting.
>
> The issue seems to be related to how the kernel interprets PT_LOAD header=
s;
> consider the following program headers (from 'readelf' of my reproduction=
):
>
> Program Headers:
>    Type  Offset   VirtAddr  PhysAddr  FileSiz  MemSiz   Flg Align
>    LOAD  0x001000 0x10000   0x10000   0x000010 0x000010 R   0x1000
>    LOAD  0x002000 0x11000   0x11000   0x000010 0x000010 RW  0x1000
>    LOAD  0x002010 0x11010   0x11010   0x000000 0x000004 RW  0x1000
>    LOAD  0x003000 0x12000   0x12000   0x0000d2 0x0000d2 R E 0x1000
>    LOAD  0x004000 0x20000   0x20000   0x000004 0x000004 RW  0x1000
>
> Old kernels load this ELF file in the following way ('/proc/self/maps'):
>
> 00010000-00011000 r--p 00001000 00:02 131  ./bug-reproduction
> 00011000-00012000 rw-p 00002000 00:02 131  ./bug-reproduction
> 00012000-00013000 r-xp 00003000 00:02 131  ./bug-reproduction
> 00020000-00021000 rw-p 00004000 00:02 131  ./bug-reproduction
>
> And new kernels do it like this:
>
> 00010000-00011000 r--p 00001000 00:02 131  ./bug-reproduction
> 00011000-00012000 rw-p 00000000 00:00 0
> 00012000-00013000 r-xp 00003000 00:02 131  ./bug-reproduction
> 00020000-00021000 rw-p 00004000 00:02 131  ./bug-reproduction
>
> That map between 0x11000 and 0x12000 is the program's '.data' and '.bss'
> sections to which it tries to write to, and since the kernel doesn't map
> them anymore it crashes.
>
> I bisected the issue to the following commit:
>
> commit 585a018627b4d7ed37387211f667916840b5c5ea
> Author: Eric W. Biederman <ebiederm@xmission.com>
> Date:   Thu Sep 28 20:24:29 2023 -0700
>
>      binfmt_elf: Support segments with 0 filesz and misaligned starts
>
> I can confirm that with this commit the issue reproduces, and with it
> reverted it doesn't.
>
> I have prepared a minimal reproduction of the problem available here,
> along with all of the scripts I used for bisecting:
>
> https://github.com/koute/linux-elf-loading-bug
>
> You can either compile it from source (requires Rust and LLD), or there's
> a prebuilt binary in 'bin/bug-reproduction` which you can run. (It's tiny=
,
> so you can easily check with 'objdump -d' that it isn't malicious).
>
> On old kernels this will run fine, and on new kernels it will segfault.

Hi!

Where did you get that linker script?

FWIW, I catched this possible issue in review, and this was already
discussed (see my email and Eric's reply):
https://lore.kernel.org/all/CAKbZUD3E2if8Sncy+M2YKncc_Zh08-86W6U5wR0ZMazShx=
bHHA@mail.gmail.com/

This was my original testcase
(https://github.com/heatd/elf-bug-questionmark), which convinced the
loader to map .data over a cleared .bss. Your bug seems similar, but
does the inverse: maps .bss over .data.

--=20
Pedro