From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752581AbcGYIT3 (ORCPT ); Mon, 25 Jul 2016 04:19:29 -0400 Received: from mout.kundenserver.de ([212.227.17.10]:63290 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751007AbcGYIT2 (ORCPT ); Mon, 25 Jul 2016 04:19:28 -0400 From: Arnd Bergmann To: linux-arm-kernel@lists.infradead.org Cc: Nicolas Pitre , Alan Cox , linux-kernel@vger.kernel.org, David Howells , linux-m68k@vger.kernel.org, Alexander Viro , linux-fsdevel@vger.kernel.org, Greg Ungerer Subject: Re: [PATCH v5 12/15] binfmt_flat: allow compressed flat binary format to work on MMU systems Date: Mon, 25 Jul 2016 10:18:52 +0200 Message-ID: <9805659.OeD7S5yAQd@wuerfel> User-Agent: KMail/5.1.3 (Linux/4.4.0-28-generic; KDE/5.18.0; x86_64; ; ) In-Reply-To: References: <1469374229-21585-1-git-send-email-nicolas.pitre@linaro.org> <4262519.L4vdOGcrh0@wuerfel> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" X-Provags-ID: V03:K0:XmLugzUxAOFp8xeagag4uDlPBVsivdZfC3h6hfagwkf+3KUMVmi yYDuEo05oxMdKayPuuznVDnDtLaWSMt3OkVLXx4nWwIR/2wVj69GXdrzLMJxrzczMj9UByY IdUXMgpp3XjjFcq09ONntHK8cCiu9TNwIw2f9edW+ypfW2Ok3rPpl4lSM8AghMIRQh0al6n PsGbZztMXIo1qqEJwMqAQ== X-UI-Out-Filterresults: notjunk:1;V01:K0:79i6zKAGD0Q=:JjzYOlAee1rf5iUvN44vim FCjOnPXzWnd3V2K9sha3TjjMIx0MIfyx7EzcEHP0VbSYZ8hDT+B710MV4h74Ng2eKqepPEgfS SxoffmyR0Z6QN+UDvTN6CuIp5xmYY7CqFtmqqui0+i7qk+uUuGMvowBNMxgyuwTj+0LOPN7QW +N0bMmq46hk1+uhuTgvpZwXvOIRHmR2iPkSvEksOYeo8NQ5TLfWqSGFm0nDyOpH6UofFma8ne DySm3VAtpQrVEeImuy3q2mOaxNZpJeUcaNkM7kZ4BqROrm+TrkDtcQFQFB/TPS0I76kEGWQzP WtTr0NyeJlAXQiQsqihDoUj33bwTQDBcI450b5oDF5NExOLLgMrm1Y5F/kDEgsuxJNkXv+YwY SJam3yFSsKArRdJpDxjkNtLtIs217NE1SMTCbOrurqcudsrmN5iEB7R37V98LheizMYqFdD11 rM+nXRHaE7zLBhL3ZoM3+7Ch/VcbsMcTv+AC6t+AcchTsRt1mPW0f61WcdX2U1QVESP7xqkQd WXDmXZBNPFhuoKJOCkIK7fWScUBV8hH7w4bKtuU0LPXGeSyUyoDsGrq7sjH2s8O0DUXn5vRKf 44kCPEgVz9jlY/fwQinDEVVVxmkncpVCDVl+jtomMRYAv2RjNSp5XDzbcxAjDnprhXva5Wdxx oc2gN4TSNFsGWCfJ0UghagH4CB+ZyEP6A8nHoM3alet7vJwTwomA1OQ/XlKaHbOAwrslZaG8t Pd7S95xK4YGmYZaB Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sunday, July 24, 2016 4:25:16 PM CEST Nicolas Pitre wrote: > On Sun, 24 Jul 2016, Arnd Bergmann wrote: > > > On Sunday, July 24, 2016 11:30:26 AM CEST Nicolas Pitre wrote: > > > +#else > > > + /* > > > + * This is used on MMU systems mainly for testing. > > > + * Let's use a kernel buffer to simplify things. > > > + */ > > > + long unz_text_len = text_len - sizeof(struct flat_hdr); > > > + long unz_len = unz_text_len + full_data; > > > + char *unz_data = vmalloc(unz_len); > > > + if (!unz_data) { > > > + result = -ENOMEM; > > > > > > > Is there a risk of a malicious user exhausting vmalloc space with a > > binary that has forged headers? If there is, maybe put an upper bound on > > the size of allocation. > > Patch #3 enforces a cap on all parameters to avoid overflows and > unreasonable section sizes. > > Then vmalloc space is used here only for decompressing the binary into, > after which the whole thing is copied to user space and the vmalloc area > is freed right away. > > > More broadly speaking, are there any other attacks that may get enabled > > through forged binaries? We've had a couple of vulnerabilities in > > binfmt_elf over the years, and I wonder how dangerous it might be > > if distros turn on binfmt_flat support by default. > > That was Alan's concern too which prompted patch #3. But with a clamp on > all parameters, everything else is done via user accessors. So an > executable still can crap onto itself or generate a segfault but I doubt > we really care at that point. > Ok, sounds good. Arnd