Commit f9c0a39d authored by Kees Cook's avatar Kees Cook
Browse files

binfmt_elf: Only report padzero() errors when PROT_WRITE 



Errors with padzero() should be caught unless we're expecting a
pathological (non-writable) segment. Report -EFAULT only when PROT_WRITE
is present.

Additionally add some more documentation to padzero(), elf_map(), and
elf_load().

Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-mm@kvack.org
Suggested-by: default avatarEric Biederman <ebiederm@xmission.com>
Tested-by: default avatarPedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: default avatarSebastian Ott <sebott@redhat.com>
Link: https://lore.kernel.org/r/20230929032435.2391507-5-keescook@chromium.org


Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent d5ca24f6

fs/binfmt_elf.c

+23 −9
Original line number Diff line number Diff line
@@ -110,19 +110,19 @@ static struct linux_binfmt elf_format = { 


#define BAD_ADDR(x) (unlikely((unsigned long)(x) >= TASK_SIZE))



/* We need to explicitly zero any fractional pages

   after the data section (i.e. bss).  This would

   contain the junk from the file that should not

   be in memory

/*

 * We need to explicitly zero any trailing portion of the page that follows

 * p_filesz when it ends before the page ends (e.g. bss), otherwise this

 * memory will contain the junk from the file that should not be present.

 */

static int padzero(unsigned long elf_bss)

static int padzero(unsigned long address)

{

	unsigned long nbyte;



	nbyte = ELF_PAGEOFFSET(elf_bss);

	nbyte = ELF_PAGEOFFSET(address);

	if (nbyte) {

		nbyte = ELF_MIN_ALIGN - nbyte;

		if (clear_user((void __user *) elf_bss, nbyte))

		if (clear_user((void __user *)address, nbyte))

			return -EFAULT;

	}

	return 0;
@@ -348,6 +348,11 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, 
	return 0;

}



/*

 * Map "eppnt->p_filesz" bytes from "filep" offset "eppnt->p_offset"

 * into memory at "addr". (Note that p_filesz is rounded up to the

 * next page, so any extra bytes from the file must be wiped.)

 */

static unsigned long elf_map(struct file *filep, unsigned long addr,

		const struct elf_phdr *eppnt, int prot, int type,

		unsigned long total_size)
@@ -387,6 +392,11 @@ static unsigned long elf_map(struct file *filep, unsigned long addr, 
	return(map_addr);

}



/*

 * Map "eppnt->p_filesz" bytes from "filep" offset "eppnt->p_offset"

 * into memory at "addr". Memory from "p_filesz" through "p_memsz"

 * rounded up to the next page is zeroed.

 */

static unsigned long elf_load(struct file *filep, unsigned long addr,

		const struct elf_phdr *eppnt, int prot, int type,

		unsigned long total_size)
@@ -404,8 +414,12 @@ static unsigned long elf_load(struct file *filep, unsigned long addr, 
			zero_end = map_addr + ELF_PAGEOFFSET(eppnt->p_vaddr) +

				eppnt->p_memsz;



			/* Zero the end of the last mapped page */

			padzero(zero_start);

			/*

			 * Zero the end of the last mapped page but ignore

			 * any errors if the segment isn't writable.

			 */

			if (padzero(zero_start) && (prot & PROT_WRITE))

				return -EFAULT;

		}

	} else {

		map_addr = zero_start = ELF_PAGESTART(addr);