From patchwork Tue Apr 12 10:03:38 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Niklas Cassel X-Patchwork-Id: 12810326 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E85FC433EF for ; Tue, 12 Apr 2022 10:03:48 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9FB3D6B0080; Tue, 12 Apr 2022 06:03:47 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 983176B0081; Tue, 12 Apr 2022 06:03:47 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7FDB96B0082; Tue, 12 Apr 2022 06:03:47 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.26]) by kanga.kvack.org (Postfix) with ESMTP id 6F1E96B0080 for ; Tue, 12 Apr 2022 06:03:47 -0400 (EDT) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 347EB22516 for ; Tue, 12 Apr 2022 10:03:47 +0000 (UTC) X-FDA: 79347790452.11.37F61F4 Received: from esa6.hgst.iphmx.com (esa6.hgst.iphmx.com [216.71.154.45]) by imf11.hostedemail.com (Postfix) with ESMTP id 39A9C40008 for ; Tue, 12 Apr 2022 10:03:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=wdc.com; i=@wdc.com; q=dns/txt; s=dkim.wdc.com; t=1649757827; x=1681293827; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=3TQDdDKv+/2Nw49GG6zX+ckjKkTqdRxGeiL8NxypWVM=; b=r5ACBx7dp6l7JxP/Y/QM7NxcD80nLHvcLXVg9FV/JMalhVE6cc7Au0Ps DIq3ur7ADHlc1u0y04mrRGxHoTaxNe7//NNgzEvLmQ2nuG5j82R2Cy2m0 niVuo5PkHvCJoH0purQR4MRrUhvsRsAXqVo+uo41dRoKSOCDkO5iGCHhu M9wNupafu5bXyiaCqpEqA5J1cv5vGrsEx686tq7HItWpkKoNKMvulPbMh U1vHc27fHvV99UNy8oPdsqOQGjrX9o45JJ2wrJAkjTMdtGJacOUqCmFKC nsdbt5k10CAjHRNBAX2NyUYrWh7WWbugTKfOIlBT85tsZzCeNhffxNwTb w==; X-IronPort-AV: E=Sophos;i="5.90,253,1643644800"; d="scan'208";a="198615222" Received: from uls-op-cesaip01.wdc.com (HELO uls-op-cesaep01.wdc.com) ([199.255.45.14]) by ob1.hgst.iphmx.com with ESMTP; 12 Apr 2022 18:03:46 +0800 IronPort-SDR: eN+9Hbqe553AvdtGM/w8CjdbIsj8bgseE+NrX8ffAsyXi8iMegnc1ubePRXuRTkE/X/AfR3PtK hbAjsyUEJZIXCxGF1MLdXLnVSR7ms5jhtWtBARM7abbJtsWM2h0vZl7kQpU8SAJwveNG0E0lYp Afk6LWO7fK2a3qyPc3iUAI6kN/t3c4gKVgubWkfOjfIv1XVDwVjg6Su/svLV22MkyUcxqhT9IY ORs8tJSp/Kaql2cPxK7MeU66KCXycxVcOOb62e1FfXb+02RDUJize3F2O4ESvMVTJ+Fl9ZHiNg s1S1ocRwwVnflAGc9I1Tc2QK Received: from uls-op-cesaip02.wdc.com ([10.248.3.37]) by uls-op-cesaep01.wdc.com with ESMTP/TLS/ECDHE-RSA-AES128-GCM-SHA256; 12 Apr 2022 02:35:00 -0700 IronPort-SDR: Uo3VSS959+vgVAzuuoPugaw2AGcOb5AzVwNMZ6muqhLfY+2hmyMI0q/omZMZn72OHgau0Abq42 QGIeU8/fIlPRG2lvaElIUsM2eZLcztSzJc1YsAxPIgjTxRuXXPwFQvY/Du7B3QqTSAk7g2hP2P LK5yMeoMrjP6oRySFuvh5X2b3C2WMKjhIZ6syvOTjxoTKXi5Kq7QoUwIbe7HP4cHnHegneiKXe Te2G2/RzHFUJoWgoIloujG4dYTCNolMO3oOb4cb5fkgNS5plzVPV6nWoCgIKl6rWHX1AqnMyYx Zvg= WDCIronportException: Internal Received: from unknown (HELO x1-carbon.cphwdc) ([10.225.164.111]) by uls-op-cesaip02.wdc.com with ESMTP; 12 Apr 2022 03:03:42 -0700 From: Niklas Cassel To: Alexander Viro , Eric Biederman , Kees Cook , Paul Walmsley , Palmer Dabbelt , Albert Ou Cc: Greg Ungerer , Mike Frysinger , Damien Le Moal , Niklas Cassel , stable@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-riscv@lists.infradead.org Subject: [PATCH] binfmt_flat: do not stop relocating GOT entries prematurely Date: Tue, 12 Apr 2022 12:03:38 +0200 Message-Id: <20220412100338.437308-1-niklas.cassel@wdc.com> X-Mailer: git-send-email 2.35.1 MIME-Version: 1.0 X-Stat-Signature: y4urjpsxmjpaq65w9bk6gk4ino4um6io Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=wdc.com header.s=dkim.wdc.com header.b=r5ACBx7d; spf=none (imf11.hostedemail.com: domain of "prvs=09443ee98=niklas.cassel@wdc.com" has no SPF policy when checking 216.71.154.45) smtp.mailfrom="prvs=09443ee98=niklas.cassel@wdc.com"; dmarc=pass (policy=quarantine) header.from=wdc.com X-Rspam-User: X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 39A9C40008 X-HE-Tag: 1649757825-720882 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: bFLT binaries are usually created using elf2flt. The linker script used by elf2flt has defined the .data section like the following for the last 19 years: .data : { _sdata = . ; __data_start = . ; data_start = . ; *(.got.plt) *(.got) FILL(0) ; . = ALIGN(0x20) ; LONG(-1) . = ALIGN(0x20) ; ... } It places the .got.plt input section before the .got input section. The same is true for the default linker script (ld --verbose) on most architectures except x86/x86-64. The binfmt_flat loader should relocate all GOT entries until it encounters a -1 (the LONG(-1) in the linker script). The problem is that the .got.plt input section starts with a GOTPLT header that has the first word (two u32 entries for 64-bit archs) set to -1. See e.g. the binutils implementation for architectures [1] [2] [3] [4]. This causes the binfmt_flat loader to stop relocating GOT entries prematurely and thus causes the application to crash when running. Fix this by ignoring -1 in the first two u32 entries in the .data section. A -1 will only be ignored for the first two entries for bFLT binaries with FLAT_FLAG_GOTPIC set, which is unconditionally set by elf2flt if the supplied ELF binary had the symbol _GLOBAL_OFFSET_TABLE_ defined, therefore ELF binaries without a .got input section should remain unaffected. Tested on RISC-V Canaan Kendryte K210 and RISC-V QEMU nommu_virt_defconfig. [1] https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=bfd/elfnn-riscv.c;hb=binutils-2_38#l3275 [2] https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=bfd/elfxx-tilegx.c;hb=binutils-2_38#l4023 [3] https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=bfd/elf32-tilepro.c;hb=binutils-2_38#l3633 [4] https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=bfd/elfnn-loongarch.c;hb=binutils-2_38#l2978 Cc: Signed-off-by: Niklas Cassel --- RISC-V elf2flt patches are still not merged, they can be found here: https://github.com/floatious/elf2flt/tree/riscv buildroot branch for k210 nommu (including this patch and elf2flt patches): https://github.com/floatious/buildroot/tree/k210-v14 fs/binfmt_flat.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c index 626898150011..b80009e6392e 100644 --- a/fs/binfmt_flat.c +++ b/fs/binfmt_flat.c @@ -793,8 +793,17 @@ static int load_flat_file(struct linux_binprm *bprm, u32 addr, rp_val; if (get_user(rp_val, rp)) return -EFAULT; - if (rp_val == 0xffffffff) + /* + * The first word in the GOTPLT header is -1 on certain + * architechtures. (On 64-bit, that is two u32 entries.) + * Ignore these entries, so that we stop relocating GOT + * entries first when we encounter the -1 after the GOT. + */ + if (rp_val == 0xffffffff) { + if (rp - (u32 __user *)datapos < 2) + continue; break; + } if (rp_val) { addr = calc_reloc(rp_val, libinfo, id, 0); if (addr == RELOC_FAILED) {