linux-kernel - [PATCH] Invalid return value of execve() resulting in oopses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4639B68D.3000700@sw.ru>
Date:	Thu, 03 May 2007 14:16:45 +0400
From:	Pavel Emelianov <xemul@...ru>
To:	Andrew Morton <akpm@...l.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
CC:	Kirill Korotaev <dev@...nvz.org>,
	Alexey Kuznetsov <alexey@...nvz.org>, devel@...nvz.org
Subject: [PATCH] Invalid return value of execve() resulting in oopses

From: Alexey Kuznetsov <alexey@...nvz.org>

When elf loader fails to map executable (due to memory shortage or
because binary is malformed), it can return 0. Normally, this is 
invisible because process is killed with SIGKILL and it never returns
to user space.

But if exec() is called from kernel thread (hotplug, whatever)
consequences are more interesting and vary depending on architecture.

i386.   Nothing especially interesting, execve() just returns 
        with "success"  :-)

x86_64. Fake zero frame is used on way to caller, RSP/RIP are loaded
        with zeros, ergo... double fault.

ia64.   Similar to i386, but r32...r95 are corrupted. Sometimes it 
        oopses due to return to zero PC, sometimes it sees NaT in 
        rXX and oopses due to NaT consumption.

Signed-off-by: Alexey Kuznetsov <alexey@...nvz.org>
Signed-off-by: Kirill Korotaev <dev@...nvz.org>
Signed-off-by: Pavel Emelianov <xemul@...nvz.org>

---

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 67d9b31..fa8ea33 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -871,6 +871,8 @@ static int load_elf_binary(struct linux_
 				elf_prot, elf_flags);
 		if (BAD_ADDR(error)) {
 			send_sig(SIGKILL, current, 0);
+			retval = IS_ERR((void *)error) ?
+				PTR_ERR((void*)error) : -EINVAL;
 			goto out_free_dentry;
 		}
 
@@ -900,6 +902,7 @@ static int load_elf_binary(struct linux_
 		    TASK_SIZE - elf_ppnt->p_memsz < k) {
 			/* set_brk can never work. Avoid overflows. */
 			send_sig(SIGKILL, current, 0);
+			retval = -EINVAL;
 			goto out_free_dentry;
 		}
 
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/