linux-kernel - Re: [PATCH] binfmt_elf: remove the 4k limitation of program header size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b98058f0-79fd-4dc5-af7f-d37941eb5707@aliyun.com>
Date: Mon, 4 Aug 2025 22:00:41 +0800
From: Yin Fengwei <nh26223@...yun.com>
To: Ismael Luceno <ismael@...ev.co.uk>,
 Yin Fengwei <fengwei_yin@...ux.alibaba.com>
Cc: Kees Cook <kees@...nel.org>, linux-kernel@...r.kernel.org,
 linux-mm@...ck.org, zhourundong.zrd@...ux.alibaba.com
Subject: Re: [PATCH] binfmt_elf: remove the 4k limitation of program header
 size



On 2025/8/4 15:19, Ismael Luceno wrote:
> On 04/Aug/2025 10:12, Yin Fengwei wrote:
>>
>>
>> 在 2025/8/3 13:28, Ismael Luceno 写道:
>>> On 02/Aug/2025 10:29, Kees Cook wrote:
>>>> On Sat, Aug 02, 2025 at 05:47:13AM +0200, Ismael Luceno wrote:
>>>>> On Sat, Jul 19, 2025 at 17:17:09 +0800, YinFengwei wrote:
>>>>>> On Thu, Jul 17, 2025 at 04:31:50PM +0800, Kees Cook wrote:
>>>>>>> On Thu, 17 Jul 2025 19:01:08 +0800, fengwei_yin@...ux.alibaba.com wrote:
>>>>>>>> We have assembly code generated by a script. GCC successfully compiles
>>>>>>>> it. However, the kernel cannot load it on an ARM64 platform with a 4K
>>>>>>>> page size. In contrast, the same ELF file loads correctly on the same
>>>>>>>> platform with a 64K page size.
>>>>>>>>
>>>>>>>> The root cause is the Linux kernel's ELF_MIN_ALIGN limitation on the
>>>>>>>> program headers of ELF files. The ELF file contains 78 program headers
>>>>>>>> (the script inserts many holes when generating the assembly code). On
>>>>>>>> ARM64 with a 4K page size, the ELF_MIN_ALLIGN enforces a maximum of 74
>>>>>>>> program headers, causing the ELF file to fail. However, with a 64K page
>>>>>>>> size, the ELF_MIN_ALIGN is relaxed to over 1,184 program headers, allowing
>>>>>>>> the file to run correctly.
>>>>>>>>
>>>>>>>> [...]
>>>>>>>
>>>>>>> Applied to for-next/execve, thanks!
>>>>>> Cook, thanks a lot.
>>>>>>
>>>>>> Regards
>>>>>> Yin, Fengwei
>>>>>>
>>>>>>>
>>>>>>> [1/1] binfmt_elf: remove the 4k limitation of program header size
>>>>>>>         https://git.kernel.org/kees/c/8030790477e8
>>>>>>>
>>>>>>> Take care,
>>>>>
>>>>> Hi,
>>>>>
>>>>> I noticed this removal and wonder whether it could be a problem on
>>>>> smaller platforms.
>>>>>
>>>>> IIRC that code has been there since ELF support was added in one
>>>>> form or another; and the idea behind it was to simplify the code
>>>>> by ensuring no cross-page reads could happen, as these could cause
>>>>> undefined behaviours or read abort exceptions.
>>>>
>>>> I didn't see a place where that would happen -- the reads aren't done on
>>>> a single page. If you see something that I missed, please let me know!
>>>
>>> The offset to the phdrs can point anywhere and the entries are
>>> arbitrarily sized, thus it can be unaligned, so we can be potentially
>>> reading at an entry right between two pages.
>>
>> The read buffer are managed in kernel. Why cross-page read can cause
>> undefined behaviors or read abort?
>>
>> Does smaller platforms have special behavior in this situation? Like
>> can't do cross-page read against the buffer allocated by kmalloc?
> 
> Pretty much anything MMU-less will fault at cross-page multi-byte reads.
> 
> I'm not aware of any system with an MMU doing that but, I think on
> RISC-V it's implementation-defined.

Checked the doc "The RISC-V Instruction Set Manual Volume I" - 17.1.1
Momory Model Primitives. The misaligned memory operations (I suppose
the cross-page multi-byte access you concerned will trigger misaligned
memory first) will be emulated by byte access. So not a problem for
Risc-V IMHO.


For MMU-less system, is it possible a 64bit system? If not, the phdr
size is 4 * 8 = 32bit. There is no cross page multi-byte access. If
it's 64 bit, it's very unlikely that it has ELF with more than 73
program headers. I am kind of sure that we are fine here.

If this is really a concern, we can add 4K restriction only for
noMMU. Thanks.


Regards
Yin, Fengwei