linux-kernel - Re: [PATCH] binfmt_elf: remove the 4k limitation of program header size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6653242a-5b08-48ff-a126-9e9367633420@linux.alibaba.com>
Date: Mon, 4 Aug 2025 10:12:52 +0800
From: Yin Fengwei <fengwei_yin@...ux.alibaba.com>
To: Ismael Luceno <ismael@...ev.co.uk>, Kees Cook <kees@...nel.org>
Cc: linux-kernel@...r.kernel.org, linux-mm@...ck.org,
 zhourundong.zrd@...ux.alibaba.com, fengwei_yin@...ux.alibaba.com
Subject: Re: [PATCH] binfmt_elf: remove the 4k limitation of program header
 size



在 2025/8/3 13:28, Ismael Luceno 写道:
> On 02/Aug/2025 10:29, Kees Cook wrote:
>> On Sat, Aug 02, 2025 at 05:47:13AM +0200, Ismael Luceno wrote:
>>> On Sat, Jul 19, 2025 at 17:17:09 +0800, YinFengwei wrote:
>>>> On Thu, Jul 17, 2025 at 04:31:50PM +0800, Kees Cook wrote:
>>>>> On Thu, 17 Jul 2025 19:01:08 +0800, fengwei_yin@...ux.alibaba.com wrote:
>>>>>> We have assembly code generated by a script. GCC successfully compiles
>>>>>> it. However, the kernel cannot load it on an ARM64 platform with a 4K
>>>>>> page size. In contrast, the same ELF file loads correctly on the same
>>>>>> platform with a 64K page size.
>>>>>>
>>>>>> The root cause is the Linux kernel's ELF_MIN_ALIGN limitation on the
>>>>>> program headers of ELF files. The ELF file contains 78 program headers
>>>>>> (the script inserts many holes when generating the assembly code). On
>>>>>> ARM64 with a 4K page size, the ELF_MIN_ALLIGN enforces a maximum of 74
>>>>>> program headers, causing the ELF file to fail. However, with a 64K page
>>>>>> size, the ELF_MIN_ALIGN is relaxed to over 1,184 program headers, allowing
>>>>>> the file to run correctly.
>>>>>>
>>>>>> [...]
>>>>>
>>>>> Applied to for-next/execve, thanks!
>>>> Cook, thanks a lot.
>>>>
>>>> Regards
>>>> Yin, Fengwei
>>>>
>>>>>
>>>>> [1/1] binfmt_elf: remove the 4k limitation of program header size
>>>>>        https://git.kernel.org/kees/c/8030790477e8
>>>>>
>>>>> Take care,
>>>
>>> Hi,
>>>
>>> I noticed this removal and wonder whether it could be a problem on
>>> smaller platforms.
>>>
>>> IIRC that code has been there since ELF support was added in one
>>> form or another; and the idea behind it was to simplify the code
>>> by ensuring no cross-page reads could happen, as these could cause
>>> undefined behaviours or read abort exceptions.
>>
>> I didn't see a place where that would happen -- the reads aren't done on
>> a single page. If you see something that I missed, please let me know!
> 
> The offset to the phdrs can point anywhere and the entries are
> arbitrarily sized, thus it can be unaligned, so we can be potentially
> reading at an entry right between two pages.

The read buffer are managed in kernel. Why cross-page read can cause
undefined behaviors or read abort?

Does smaller platforms have special behavior in this situation? Like
can't do cross-page read against the buffer allocated by kmalloc?


Regards
Yin, Fengwei