linux-kernel - Re: [PATCH] elf: fix "start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 23 May 2019 22:35:05 +0300
From:   Alexey Dobriyan <adobriyan@...il.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: [PATCH] elf: fix "start_code" evaluation

On Thu, May 23, 2019 at 11:44:17AM -0700, Andrew Morton wrote:
> On Thu, 23 May 2019 20:57:36 +0300 Alexey Dobriyan <adobriyan@...il.com> wrote:
> 
> > Only executable ELF program headers should change ->start_code.
> > 
> > ...
> >
> > --- a/fs/binfmt_elf.c
> > +++ b/fs/binfmt_elf.c
> > @@ -1026,7 +1026,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
> >  			}
> >  		}
> >  		k = elf_ppnt->p_vaddr;
> > -		if (k < start_code)
> > +		if ((elf_ppnt->p_flags & PF_X) && k < start_code)
> >  			start_code = k;
> >  		if (start_data < k)
> >  			start_data = k;
> 
> What problem does this solve?

It is a bug. Look at the ->end_code update:

	if ((elf_ppnt->p_flags & PF_X) && end_code < k)
		end_code = k;

> How does it alter runtime behaviour?

It makes "VmExe" and "VmLib" accounting more accurate for common case.

> How do we know it won't break anything?

We don't. Some distros are unaffected because they ship binaries with
first PT_LOAD segment being executable (Debian 8). Some don't.

Regardless, these fields are lies: ELF binary can have multiple disjoint
PT_LOAD segments, but all those ->start and ->end fields assume everything
is mapped together.

Hopefully nobody actually uses them for anything serious.