linux-kernel - Re: [PATCH 1/2] module: Overwrite st_size instead of st

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181122122411.6ydftk7bjlrefwa5@axis.com>
Date:   Thu, 22 Nov 2018 13:24:11 +0100
From:   Vincent Whitchurch <vincent.whitchurch@...s.com>
To:     Dave Martin <Dave.Martin@....com>
Cc:     linux@...linux.org.uk, jeyu@...nel.org,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] module: Overwrite st_size instead of st_info

On Thu, Nov 22, 2018 at 12:01:54PM +0000, Dave Martin wrote:
> On Mon, Nov 19, 2018 at 05:25:12PM +0100, Vincent Whitchurch wrote:
> > st_info is currently overwritten after relocation and used to store the
> > elf_type().  However, we're going to need it fix kallsyms on ARM's
> > Thumb-2 kernels, so preserve st_info and overwrite the st_size field
> > instead.  st_size is neither used by the module core nor by any
> > architecture.
> > 
> > Signed-off-by: Vincent Whitchurch <vincent.whitchurch@...s.com>
> > ---
> > v4: Split out to separate patch.  Use st_size instead of st_other.
> > v1-v3: See PATCH 2/2
> > 
> >  kernel/module.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/kernel/module.c b/kernel/module.c
> > index 49a405891587..3d86a38b580c 100644
> > --- a/kernel/module.c
> > +++ b/kernel/module.c
> > @@ -2682,7 +2682,7 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
> >  
> >  	/* Set types up while we still have access to sections. */
> >  	for (i = 0; i < mod->kallsyms->num_symtab; i++)
> > -		mod->kallsyms->symtab[i].st_info
> > +		mod->kallsyms->symtab[i].st_size
> >  			= elf_type(&mod->kallsyms->symtab[i], info);
> >  
> >  	/* Now populate the cut down core kallsyms for after init. */
> > @@ -4061,7 +4061,7 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
> >  		kallsyms = rcu_dereference_sched(mod->kallsyms);
> >  		if (symnum < kallsyms->num_symtab) {
> >  			*value = kallsyms->symtab[symnum].st_value;
> > -			*type = kallsyms->symtab[symnum].st_info;
> > +			*type = kallsyms->symtab[symnum].st_size;
> >  			strlcpy(name, symname(kallsyms, symnum), KSYM_NAME_LEN);
> >  			strlcpy(module_name, mod->name, MODULE_NAME_LEN);
> >  			*exported = is_exported(name, *value, mod);
> 
> This is fine if st_size is really unused, but how sure are you of that?
> 
> grepping for st_size throws up some hits that appear ELF-related, but
> I've not investigated them in detail.
> 
> (The fact that struct stat has an identically named field throws up
> a load of false positives too.)

$ git describe --tags
v4.20-rc3-93-g92b419289cee
 
$ rg -m1 '[\.>]st_size'  --iglob '!**/tools/**' --iglob '!**/vdso*' --iglob '!**/scripts/**' --iglob '!**/usr/**' --iglob '!**/samples/**' | cat
| kernel/kexec_file.c:	if (sym->st_size != size) {

Symbols in kexec kernel.

| fs/stat.c:	tmp.st_size = stat->size;
| Documentation/networking/tls.txt:  sendfile(sock, file, &offset, stat.st_size);
| net/9p/client.c:		ret->st_rdev, ret->st_size, ret->st_blksize,
| net/9p/protocol.c:					&stbuf->st_rdev, &stbuf->st_size,
| fs/9p/vfs_inode_dotl.c:		i_size_write(inode, stat->st_size);
| fs/hostfs/hostfs_user.c:	p->size = buf->st_size;
| arch/powerpc/boot/mktree.c:	nblks = (st.st_size + IMGBLK) / IMGBLK;
| arch/alpha/kernel/osf_sys.c:	tmp.st_size	= lstat->size;
| arch/x86/ia32/sys_ia32.c:	    __put_user(stat->size, &ubuf->st_size) ||

Not Elf_Sym.

| arch/x86/kernel/machine_kexec_64.c:			 sym->st_size);

Symbols in kexec kernel.

| arch/sparc/boot/piggyback.c:	st4(buffer + 12, s.st_size);
| arch/sparc/kernel/sys_sparc32.c:	err |= put_user(stat->size, &statbuf->st_size);
| arch/um/os-Linux/file.c:		.ust_size    = src->st_size,    /* total size, in bytes */
| arch/um/os-Linux/start_up.c:	size = (buf.st_size + UM_KERN_PAGE_SIZE) & ~(UM_KERN_PAGE_SIZE - 1);
| arch/s390/kernel/compat_linux.c:	tmp.st_size = stat->size;
| arch/arm/kernel/sys_oabi-compat.c:	tmp.st_size = stat->size;
| arch/mips/boot/compressed/calc_vmlinuz_load_addr.c:	vmlinux_size = (uint64_t)sb.st_size;
| drivers/net/ethernet/marvell/sky2.c:		hw->st_idx = RING_NEXT(hw->st_idx, hw->st_size);

Not Elf_Sym.