linux-kernel - [PATCH] binfmt_elf: remove the 4k limitation of program header size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250717110108.55586-1-fengwei_yin@linux.alibaba.com>
Date: Thu, 17 Jul 2025 19:01:08 +0800
From: fengwei_yin@...ux.alibaba.com
To: linux-kernel@...r.kernel.org,
	linux-mm@...ck.org
Cc: kees@...nel.org,
	fengwei_yin@...ux.alibaba.com,
	zhourundong.zrd@...ux.alibaba.com
Subject: [PATCH] binfmt_elf: remove the 4k limitation of program header size

From: Yin Fengwei <fengwei_yin@...ux.alibaba.com>

We have assembly code generated by a script. GCC successfully compiles
it. However, the kernel cannot load it on an ARM64 platform with a 4K
page size. In contrast, the same ELF file loads correctly on the same
platform with a 64K page size.

The root cause is the Linux kernel's ELF_MIN_ALIGN limitation on the
program headers of ELF files. The ELF file contains 78 program headers
(the script inserts many holes when generating the assembly code). On
ARM64 with a 4K page size, the ELF_MIN_ALLIGN enforces a maximum of 74
program headers, causing the ELF file to fail. However, with a 64K page
size, the ELF_MIN_ALIGN is relaxed to over 1,184 program headers, allowing
the file to run correctly.

Cook kindly identified that this limitation was introduced in
Linux-0.99.15f without an explanation for its purpose [1].

The ELF specification does not impose such a restriction on program
headers. Removing the ELF_MIN_ALIGN limitation on program headers to
align with the ELF spec. After removing ELF_MIN_ALIGN limitation,
64K size limitation still exist which should be sufficient.

[1] https://lore.kernel.org/linux-mm/202506270854.A729825@keescook/

Originally-by: Kees Cook <kees@...nel.org>
Signed-off-by: Yin Fengwei <fengwei_yin@...ux.alibaba.com>
---
Explaination about "Originally-by": it's debug code from Cook. And
he didn't show the intention to submit it as patch. The change did
fix the issue I hit...

 fs/binfmt_elf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index a43363d593e5..1cb35a2bc528 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -519,7 +519,7 @@ static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex,
 	/* Sanity check the number of program headers... */
 	/* ...and their total size. */
 	size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
-	if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN)
+	if (size == 0 || size > 65536)
 		goto out;

 	elf_phdata = kmalloc(size, GFP_KERNEL);
-- 
2.49.0