From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3DCC2E82CD3 for ; Wed, 27 Sep 2023 20:19:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229690AbjI0UTF (ORCPT ); Wed, 27 Sep 2023 16:19:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46534 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229437AbjI0UTD (ORCPT ); Wed, 27 Sep 2023 16:19:03 -0400 Received: from out01.mta.xmission.com (out01.mta.xmission.com [166.70.13.231]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 09D2E11D; Wed, 27 Sep 2023 13:19:02 -0700 (PDT) Received: from in01.mta.xmission.com ([166.70.13.51]:46428) by out01.mta.xmission.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1qlazr-005jV1-5R; Wed, 27 Sep 2023 14:18:59 -0600 Received: from ip68-227-168-167.om.om.cox.net ([68.227.168.167]:42922 helo=email.froward.int.ebiederm.org.xmission.com) by in01.mta.xmission.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1qlazp-005ur2-UD; Wed, 27 Sep 2023 14:18:58 -0600 From: "Eric W. Biederman" To: Kees Cook Cc: Alexander Viro , Christian Brauner , linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, Sebastian Ott , Thomas =?utf-8?Q?Wei=C3=9Fschuh?= , Pedro Falcato , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org References: <20230927033634.make.602-kees@kernel.org> <20230927034223.986157-3-keescook@chromium.org> Date: Wed, 27 Sep 2023 15:18:34 -0500 In-Reply-To: <20230927034223.986157-3-keescook@chromium.org> (Kees Cook's message of "Tue, 26 Sep 2023 20:42:20 -0700") Message-ID: <87y1gr8j51.fsf@email.froward.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1qlazp-005ur2-UD;;;mid=<87y1gr8j51.fsf@email.froward.int.ebiederm.org>;;;hst=in01.mta.xmission.com;;;ip=68.227.168.167;;;frm=ebiederm@xmission.com;;;spf=pass X-XM-AID: U2FsdGVkX19RBgBS8g27Lxlq2bg39xuBcUJPOTSRDNI= X-SA-Exim-Connect-IP: 68.227.168.167 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [PATCH v3 3/4] binfmt_elf: Provide prot bits as context for padzero() errors X-SA-Exim-Version: 4.2.1 (built Sat, 08 Feb 2020 21:53:50 +0000) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Kees Cook writes: > Errors with padzero() should be caught unless we're expecting a > pathological (non-writable) segment. Report -EFAULT only when PROT_WRITE > is present. > > Additionally add some more documentation to padzero(), elf_map(), and > elf_load(). I wonder if this might be easier to just perform the PROT_WRITE test in elf_load, and to completely skip padzero of PROT_WRITE is not present. Eric > Cc: Eric Biederman > Cc: Alexander Viro > Cc: Christian Brauner > Cc: linux-fsdevel@vger.kernel.org > Cc: linux-mm@kvack.org > Suggested-by: Eric Biederman > Signed-off-by: Kees Cook > --- > fs/binfmt_elf.c | 33 +++++++++++++++++++++++---------- > 1 file changed, 23 insertions(+), 10 deletions(-) > > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c > index 0214d5a949fc..b939cfe3215c 100644 > --- a/fs/binfmt_elf.c > +++ b/fs/binfmt_elf.c > @@ -110,19 +110,21 @@ static struct linux_binfmt elf_format = { > > #define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE)) > > -/* We need to explicitly zero any fractional pages > - after the data section (i.e. bss). This would > - contain the junk from the file that should not > - be in memory > +/* > + * We need to explicitly zero any trailing portion of the page that follows > + * p_filesz when it ends before the page ends (e.g. bss), otherwise this > + * memory will contain the junk from the file that should not be present. > */ > -static int padzero(unsigned long elf_bss) > +static int padzero(unsigned long address, int prot) > { > unsigned long nbyte; > > - nbyte = ELF_PAGEOFFSET(elf_bss); > + nbyte = ELF_PAGEOFFSET(address); > if (nbyte) { > nbyte = ELF_MIN_ALIGN - nbyte; > - if (clear_user((void __user *) elf_bss, nbyte)) > + /* Only report errors when the segment is writable. */ > + if (clear_user((void __user *)address, nbyte) && > + prot & PROT_WRITE) > return -EFAULT; > } > return 0; > @@ -348,6 +350,11 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, > return 0; > } > > +/* > + * Map "eppnt->p_filesz" bytes from "filep" offset "eppnt->p_offset" > + * into memory at "addr". (Note that p_filesz is rounded up to the > + * next page, so any extra bytes from the file must be wiped.) > + */ > static unsigned long elf_map(struct file *filep, unsigned long addr, > const struct elf_phdr *eppnt, int prot, int type, > unsigned long total_size) > @@ -387,6 +394,11 @@ static unsigned long elf_map(struct file *filep, unsigned long addr, > return(map_addr); > } > > +/* > + * Map "eppnt->p_filesz" bytes from "filep" offset "eppnt->p_offset" > + * into memory at "addr". Memory from "p_filesz" through "p_memsz" > + * rounded up to the next page is zeroed. > + */ > static unsigned long elf_load(struct file *filep, unsigned long addr, > const struct elf_phdr *eppnt, int prot, int type, > unsigned long total_size) > @@ -405,7 +417,8 @@ static unsigned long elf_load(struct file *filep, unsigned long addr, > eppnt->p_memsz; > > /* Zero the end of the last mapped page */ > - padzero(zero_start); > + if (padzero(zero_start, prot)) > + return -EFAULT; > } > } else { > map_addr = zero_start = ELF_PAGESTART(addr); > @@ -712,7 +725,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, > * the file up to the page boundary, and zero it from elf_bss > * up to the end of the page. > */ > - if (padzero(elf_bss)) { > + if (padzero(elf_bss, bss_prot)) { > error = -EFAULT; > goto out; > } > @@ -1407,7 +1420,7 @@ static int load_elf_library(struct file *file) > goto out_free_ph; > > elf_bss = eppnt->p_vaddr + eppnt->p_filesz; > - if (padzero(elf_bss)) { > + if (padzero(elf_bss, PROT_WRITE)) { > error = -EFAULT; > goto out_free_ph; > }