linux-kernel - Re: Bug 215734 - shared object loaded very low in memory ARM 32bit with kernel 5.17.0 #forregzbot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e5c8cccd-c9dd-ff80-ae88-b47f70f66c6a@leemhuis.info>
Date:   Sat, 16 Apr 2022 06:42:39 +0200
From:   Thorsten Leemhuis <regressions@...mhuis.info>
To:     "regressions@...ts.linux.dev" <regressions@...ts.linux.dev>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: Bug 215734 - shared object loaded very low in memory ARM 32bit
 with kernel 5.17.0 #forregzbot

TWIMC: this mail is primarily send for documentation purposes and for
regzbot, my Linux kernel regression tracking bot. These mails usually
contain '#forregzbot' in the subject, to make them easy to spot and filter.

#regzbot fixed-by: aeb7923733d100


On 31.03.22 08:17, Thorsten Leemhuis wrote:
> Hi, this is your Linux kernel regression tracker.
> 
> I noticed a regression report in bugzilla.kernel.org that afaics nobody
> acted upon since it was reported about a week ago, that's why I decided
> to forward it to the lists and all people that seemed to be relevant
> here. Note, this is the second regression report referencin a commit
> from H.J. Lu as culprit (9630f0d60fec ("fs/binfmt_elf: use PT_LOAD
> p_align values for static PIE")). I forwarded the first one on Monday
> already, but seems nothing happened:
> https://lore.kernel.org/all/cb5b81bd-9882-e5dc-cd22-54bdbaaefbbc@leemhuis.info/
> 
> Anyway, to get back to the latest report. To quote from
> https://bugzilla.kernel.org/show_bug.cgi?id=215734 :
> 
>>  Jan Palus 2022-03-24 10:17:02 UTC
>>
>> This is a followup to https://sourceware.org/bugzilla/show_bug.cgi?id=28990 where ld.so --verify segfault was reported on binaries > 4MB.
>>
>> It appears that starting with kernel 5.17.0 shared object is loaded in the begging of address space at least on 32-bit ARM:
>>
>> /proc/<pid>/maps just before mmap (5.17):
>> 00400000-00429000 r-xp 00000000 b3:02 393320     /lib/ld-linux-armhf.so.3
>> 00439000-0043c000 rw-p 00029000 b3:02 393320     /lib/ld-linux-armhf.so.3
>> 76ffd000-76ffe000 r-xp 00000000 00:00 0          [sigpage]
>> 76ffe000-76fff000 r--p 00000000 00:00 0          [vvar]
>> 76fff000-77000000 r-xp 00000000 00:00 0          [vdso]
>> 7efdf000-7f000000 rw-p 00000000 00:00 0          [stack]
>> ffff0000-ffff1000 r-xp 00000000 00:00 0          [vectors]
>>
>> causing segfaults when mmaping large binaries at fixed address 0x10000 (ie done by ld.so --verify used by ldd).
>>
>> By comparison it is not the case for kernel 5.16.8:
>>
>> /proc/<pid>/maps just before mmap (5.16):
>> 76fc4000-76fed000 r-xp 00000000 b3:02 393320     /lib/ld-linux-armhf.so.3
>> 76ffa000-76ffb000 r-xp 00000000 00:00 0          [sigpage]
>> 76ffb000-76ffc000 r--p 00000000 00:00 0          [vvar]
>> 76ffc000-76ffd000 r-xp 00000000 00:00 0          [vdso]
>> 76ffd000-77000000 rw-p 00029000 b3:02 393320     /lib/ld-linux-armhf.so.3
>> 7efdf000-7f000000 rw-p 00000000 00:00 0          [stack]
>> ffff0000-ffff1000 r-xp 00000000 00:00 0          [vectors]
>>
>> [reply] [−] Comment 1 Jan Palus 2022-03-29 22:14:12 UTC
>>
>> First bad commit appears to be:
>>
>> From: "H.J. Lu" <hjl.tools@...il.com>
>> Date: Wed, 19 Jan 2022 18:09:40 -0800
>> Subject: fs/binfmt_elf: use PT_LOAD p_align values for static PIE
>>
>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9630f0d60fec5fbcaa4435a66f75df1dc9704b66
>>
> 
> Could somebody take a look into this? Or was this discussed somewhere
> else already? Or even fixed?
> 
> 
> Anyway, to get this tracked:
> 
> #regzbot introduced: 9630f0d60fec5fbcaa4435a66f75df1dc9704b6
> #regzbot from: Jan Palus <jpalus@...tmail.com>
> #regzbot title: shared object loaded very low in memory ARM 32bit
> causing segfaults on binaries > 4MB
> #regzbot link: https://bugzilla.kernel.org/show_bug.cgi?id=215734
> 
> Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
> 
> P.S.: As the Linux kernel's regression tracker I'm getting a lot of
> reports on my table. I can only look briefly into most of them and lack
> knowledge about most of the areas they concern. I thus unfortunately
> will sometimes get things wrong or miss something important. I hope
> that's not the case here; if you think it is, don't hesitate to tell me
> in a public reply, it's in everyone's interest to set the public record
> straight.
>