linux-kernel - Re: [PATCH] fs/binfmt_elf: use ELF_ET_DYN_BASE for PIE (ET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 31 Jan 2022 13:30:38 -0800
From:   "H.J. Lu" <hjl.tools@...il.com>
To:     Azat Khuzhin <a3at.mail@...il.com>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Chris Kennelly <ckennelly@...gle.com>,
        Al Viro <viro@...iv.linux.org.uk>,
        Alexey Dobriyan <adobriyan@...il.com>,
        Song Liu <songliubraving@...com>,
        David Rientjes <rientjes@...gle.com>,
        Ian Rogers <irogers@...gle.com>,
        Hugh Dickins <hughd@...gle.com>,
        Suren Baghdasaryan <surenb@...gle.com>,
        Sandeep Patil <sspatil@...gle.com>,
        Fangrui Song <maskray@...gle.com>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        "Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>,
        Mike Kravetz <mike.kravetz@...cle.com>,
        Shuah Khan <shuah@...nel.org>
Subject: Re: [PATCH] fs/binfmt_elf: use ELF_ET_DYN_BASE for PIE (ET_DYN with
 INTERP) binaries

On Mon, Jan 31, 2022 at 12:17 PM Azat Khuzhin <a3at.mail@...il.com> wrote:
>
> Since 9630f0d60fec ELF_ET_DYN_BASE is not used as a load_bias anymore
> and this breaks PIE binaries, since after this change data segment
> became too nearby the stack:
>
> Before 9630f0d60fec:
>
>     $ strace -febrk /tmp/test-stack |& head
>     brk(NULL)                               = 0x555555559000
>     $ /tmp/test-stack
>     bottom_of_stack = 0x7fffffffc5c0
>     recursion depth: 1 (stack diff: 32)
>     ...
>     recursion depth: 7690 (stack diff: 8365664)
>     Segmentation fault (core dumped)
>
> After 9630f0d60fec:
>
>     $ strace -ebrk /tmp/test-stack  |& head
>     brk(NULL)                               = 0x7ffff7fff000
>
>     $ /tmp/test-stack
>     bottom_of_stack = 0x7fffffffc640
>     recursion depth: 1 (stack diff: 32)
>     ...
>     recursion depth: 146 (stack diff: 157792)
>     Segmentation fault (core dumped)
>
> Found this during compiling with clang, that started to randomly
> SIGSEGV when it eats some heap.

How do I reproduce it on x86-64?

> Reproducer:
>
>     #include <stdio.h>
>     #include <stddef.h>
>     #include <stdlib.h>
>
>     static int depth = 0;
>     static void* bottom_of_stack;
>
>     int inner()
>     {
>         char buffer[1024];
>         ptrdiff_t diff;
>         int ret;
>
>         ++depth;
>         diff = bottom_of_stack - __builtin_frame_address(0);
>
>         fprintf(stderr,
>                 "recursion depth: %i (stack diff: %zu)\n",
>                 depth, (size_t)diff);
>
>         for (size_t i = 0; i < 1024; ++i)
>                 ret += buffer[i];
>
>         ret += inner();
>
>         return ret;
>     }
>
>     int main()
>     {
>         for (size_t size = 0; size < 128<<20; size += 16<<10)
>                 malloc(16<<10);
>
>         bottom_of_stack = __builtin_frame_address(0);
>         fprintf(stderr, "bottom_of_stack = %p\n", bottom_of_stack);
>         inner();
>     }
>
> Fixes: 9630f0d60fec ("fs/binfmt_elf: use PT_LOAD p_align values for static PIE")
> Signed-off-by: Azat Khuzhin <a3at.mail@...il.com>
> Cc: Chris Kennelly <ckennelly@...gle.com>
> Cc: Al Viro <viro@...iv.linux.org.uk>
> Cc: Alexey Dobriyan <adobriyan@...il.com>
> Cc: Song Liu <songliubraving@...com>
> Cc: David Rientjes <rientjes@...gle.com>
> Cc: Ian Rogers <irogers@...gle.com>
> Cc: Hugh Dickins <hughd@...gle.com>
> Cc: Suren Baghdasaryan <surenb@...gle.com>
> Cc: Sandeep Patil <sspatil@...gle.com>
> Cc: Fangrui Song <maskray@...gle.com>
> Cc: Nick Desaulniers <ndesaulniers@...gle.com>
> Cc: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
> Cc: Mike Kravetz <mike.kravetz@...cle.com>
> Cc: Shuah Khan <shuah@...nel.org>
> Cc: H.J. Lu <hjl.tools@...il.com>
> ---
>  fs/binfmt_elf.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index 605017eb9349..9e11e6f13e83 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -1117,7 +1117,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
>                          * without MAP_FIXED nor MAP_FIXED_NOREPLACE).
>                          */
>                         alignment = maximum_alignment(elf_phdata, elf_ex->e_phnum);
> -                       if (alignment > ELF_MIN_ALIGN) {
> +                       if (interpreter || alignment > ELF_MIN_ALIGN) {
>                                 load_bias = ELF_ET_DYN_BASE;
>                                 if (current->flags & PF_RANDOMIZE)
>                                         load_bias += arch_mmap_rnd();
> --
> 2.35.1
>


-- 
H.J.