From patchwork Fri Jun 21 20:50:43 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13708055 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB115C27C4F for ; Fri, 21 Jun 2024 20:50:50 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 428788D0190; Fri, 21 Jun 2024 16:50:50 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 3D7D46B0470; Fri, 21 Jun 2024 16:50:50 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 251168D0190; Fri, 21 Jun 2024 16:50:50 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id E66B16B046A for ; Fri, 21 Jun 2024 16:50:49 -0400 (EDT) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 99C9CA3DEC for ; Fri, 21 Jun 2024 20:50:49 +0000 (UTC) X-FDA: 82256089818.22.5E724A3 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf18.hostedemail.com (Postfix) with ESMTP id E25C41C000F for ; Fri, 21 Jun 2024 20:50:47 +0000 (UTC) Authentication-Results: imf18.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=TLrlDt0+; spf=pass (imf18.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1719003040; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=I/LMXCsgtTZqfvCuSBlLGyoI5/XfP5X/Az/KrnN85/Q=; b=0J40AmU7t5ZJtpSW+ifFyQqy04d6GGXQm1zAoMIwNrNoosZkLuDyXmXGQ2kpzwX4H3Pq8u RvtAE0Mxg2efQnp1UAhQx3vNK8R3T5vzMDbfYfLxREwtu7uhZFOLxUCvNToUIbcQdd/rk0 pMN9kchuP1ijkTD1exWUmEYO1SxNtFA= ARC-Authentication-Results: i=1; imf18.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=TLrlDt0+; spf=pass (imf18.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1719003040; a=rsa-sha256; cv=none; b=uNuvisJIjzrJKeSFea5CDZpIAclaN3a2c8OdFclZyc5e9jQnYywa7Yary1ecX2cveZEx+Z nW7mYJpzK668kRz2kXJTujGhw0cm4kIjLBTw4wklgB5ES+rQyklkPqXsVGZEN27hEhpRQ+ 4dJeB9Xm2F3BTABTX9P9ncl/5PutXHw= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id E0D9761F14; Fri, 21 Jun 2024 20:50:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8D5D2C2BBFC; Fri, 21 Jun 2024 20:50:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1719003046; bh=08nbucMThJ3PA9ERR1mzxp2dFYTwOJzapfx7t7pEvKw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TLrlDt0+nOx1CCG90R/6CZa8aFePcr7Fh/AeYwaCqHSxu5FfsfEojI7ZgaeGgtqtI 5XCG39Hh1W6x1coVzwHlQBQD6E7g+lgJfkSmFWJyyL5J33bhPIxoawQN6jHhSJI6Hv QBI0xRNJZLfAQc2iyBaGfKih6Dstk/bIcXw+cUHPQfTnnkm3tHEI0HEmstimhUuwOk o45jBz6xPL57QIXS9IXaN6Ysv7asvRwsPO9ZDLDq01zdzCogmhi2dD2Eneob3Svr/w Ao2EL1yAr4eLyMJTaqqeFfduG05K03dovRWo9UKw9U2mjglj9ZUtJEmECDfzZGC+2c E+yOfeRVfM69w== From: Kees Cook To: Guenter Roeck Cc: Kees Cook , Eric Biederman , Alexander Viro , Christian Brauner , Jan Kara , Alexey Dobriyan , Laurent Vivier , Lukas Bulwahn , linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, Justin Stitt , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 1/2] execve: Keep bprm->argmin behind CONFIG_MMU Date: Fri, 21 Jun 2024 13:50:43 -0700 Message-Id: <20240621205046.4001362-1-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240621204729.it.434-kees@kernel.org> References: <20240621204729.it.434-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3893; i=kees@kernel.org; h=from:subject; bh=08nbucMThJ3PA9ERR1mzxp2dFYTwOJzapfx7t7pEvKw=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBmdeekFSbBk2O2iHqrCrSBFtyRjbOTF4Orfwi4G NzijvpupVKJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZnXnpAAKCRCJcvTf3G3A JhSOEACWWK0PtH8YUUh7IL6RFGs61JDtltA65r7YwqGHW9pAb9Ei2/Pm9tSrkRjjCQJJzSUlijZ sIJL7ggzsjCbCl1l/PFkcuvC6PFmLFZ9YeyqUF0a8srpivUSLRkm7rVqiJuQ+xSRJVHc29A/ugS FS6t1mFxeikcvz9vHMaqpgenvD4Mgl14Rb4oedV0SP3ZB15v8eABGMoY4cTC3Bw0mLltSXzHm0I 1gn7FNVNhFnNJFD2t/fVw/u8uwmeGIUaAEE6J33lGvlvMJbxBFp8umKg6a6w/+98mE8jSksVIoE Pok5N1XYsTDENcddKk0ZHkY6W0ux+c967CH87wD17w2K8rgr2sFGddRYxCUSU0KG7LZFu6OR9vZ /OZKQfAZCoPw0rTZrZc1H62h7goz0vPuTsovL9Z7Y9AxFyW5AcEsqI2HNvtBhqndK3yc1myJpdP 3hJY0DDp4lEyk5qjqG1/wgir84UVSO9TISyB7t0CfX8LNOXI7cJiHUd89R/UyiAhtm02dF1QHAI 8/+q/y2dgHXVv4esZytTnXmkwtm2oZU8jjiTNfSfO9/LZElw3wMeoze4TGuAhM6wwQA7n7pQDZn tRgSx5v0//uEVarmd41/WOez36Qxoaxs5W8UfR+zanBm4abpwbd21c9B+5sxEHAOmRSxj6FmFVF k5BWD3WJLC17tDg= = X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Stat-Signature: tekk96oowns5f67n8ffy1sm9bok9q4yg X-Rspam-User: X-Rspamd-Queue-Id: E25C41C000F X-Rspamd-Server: rspam02 X-HE-Tag: 1719003047-530360 X-HE-Meta: U2FsdGVkX1/QFVQI9+Cs7KKwNiqCw5jVFhSNwuWHubxwTSukXodi5/3ZLaUPVUJjMpGey0wzCQWb672ClwPlq8QpHRhG+6UYzc/9DFbX8fcFjGVUUSbunBG4ZTDTxoKzKm6BvMNPvTrKuzGMeRo1fybJWKwaGmHw9utDPv9kzEpIf13EN2C0zF/8vKVYor4HbZ8dBkAS4a/gKHApR53QXkKP/mGwp2eFN3VeT0QAmHvvC05m9/loZu1Wc89X2ea5MUCSibSJlAO7lh0kIhSNPad+R4JjG7rl/j53GCwA20XBZptVjUS4BPIcJdzAYPzLy2kHorcKKJANfmz/YCoKDaCI3fMmJ3V/Lf7Z8IjiCf+npVFlfhMHclCZ3/+KSfyHL6oIkoiLWT7Ltki/+//e4jovm/3c7ZWynAI2/MKV6hFwvRJ8GSCz38UlVt4l3/nzVmGraB0DGc255C0hJrLnfFxApQ3go0+Hrz0gAh7Z02A4rqSjKaG93gVfr4bF1Q+tcRwwMdV/Ni7LKA0cX1VjfkDuXgwVsTdtxFvWC+NhLuNvPgo7yE7AhE4aQD/QY6CFRZ1wKA8boMDESROupQ8mmQCpqsQQ77OgErfWBNaYYi0oPiyzBsCWXZ8J3nwtn7vnImswqjs9KENKDUGDzTs+DjKDHs5bDNO3Adcy4Th286SykC5z0dDvEY92nF41l2YTQGK/kjamu1YcSN04DNMWufe284GeJY1uNRtnWF+QAMYsVRnvK6MBNlCNKd7/g4VWh0eD0Oo0pVbDuVn93PnzYNHftMVuxdZ34eleG2SsuyoocwwI2qqsWG7tbT+dKbUiTY26GsNyqnSlE5oC/sNZe5Je5XQe4ojmW60iWyz0xV5CJ7t07lz3sQeCD/B8Y0A82jRcwn9KQCTzdS9ZpJsth157r1d1OsSX5GoU7VRtxI8yMzrdoTmBuqemWQMaZ1PRLK0yZ0H3QJr0JWC4MpD f4S1+fx0 vA81U3fhmOHq6fFZL2zFznq1z+dbFq52zYUsrO2UoXc++5DYoRcWOBAfKJPs0WZGFg/wH5BXPqknBFhA9G7NcQw9xApBpHfUK0Fr9MNC/2ubExk6sX+JRRQhRv6+l11euqUFHhbc70JmlTQCjkjavcV9PO/PM6ob5jv98v+q02ctwAbIg8pWg6D4Y2DaqxOV3Eno7a31FKY9FYlU33VucUpK54GBTbC6jYTKdS4S9rmgoEFuZL9rYDnH2LDQ0zGMQpVq5Gf9UjjB6IwD3YqoCj2/sYSsnb/f8gKYdkNw43Z8F/LwSa2J6iIOLV7rregDnZMxizY9akr68QqVea0y1/jOIW9oD7+NCSHiH+2aLOSgTTXLA4YWoc1VoxWupiVG0HktgLKvxsku9uoHqxp7WXIzlQAZiZ42KLY8Yo2ixKOtVIRV52xGdkaWbMYYksc4u9Nd0IVU5psOsEgQL4VQDB7k9/bQa4GwGKqSe71Fl2p7Vne4rRUk8q16k4QnP1X86zhzGPKSQfW15OSxfYlCIfoJLQmBOTDMMNiA4bqTFgEUX0qnIoYBbXevkm6Qp02OR+BST5eMOA4n7kVbLk991GuzkTCuCz3JpeHbcOSKhA5E0uYRduRfSqF4Ss18TU+cRhkSn/j2I/UXGJhFmK/RLBJ4uoW21Qg4CKEr2wJacM9kpzJq1W8819F3auFmrkHg2QMuv X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: When argmin was added in commit 655c16a8ce9c ("exec: separate MM_ANONPAGES and RLIMIT_STACK accounting"), it was intended only for validating stack limits on CONFIG_MMU[1]. All checking for reaching the limit (argmin) is wrapped in CONFIG_MMU ifdef checks, though setting argmin was not. That argmin is only supposed to be used under CONFIG_MMU was rediscovered recently[2], and I don't want to trip over this again. Move argmin's declaration into the existing CONFIG_MMU area, and add helpers functions so the MMU tests can be consolidated. Link: https://lore.kernel.org/all/20181126122307.GA1660@redhat.com [1] Link: https://lore.kernel.org/all/202406211253.7037F69@keescook/ [2] Signed-off-by: Kees Cook --- Cc: Guenter Roeck Cc: Eric Biederman Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Cc: Alexey Dobriyan Cc: Laurent Vivier Cc: Lukas Bulwahn Cc: linux-fsdevel@vger.kernel.org Cc: linux-mm@kvack.org --- fs/exec.c | 26 ++++++++++++++++++++------ fs/exec_test.c | 2 ++ include/linux/binfmts.h | 2 +- 3 files changed, 23 insertions(+), 7 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index c3bec126505b..b7bc63bfb907 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -486,6 +486,23 @@ static int count_strings_kernel(const char *const *argv) return i; } +static inline int bprm_set_stack_limit(struct linux_binprm *bprm, + unsigned long limit) +{ +#ifdef CONFIG_MMU + bprm->argmin = bprm->p - limit; +#endif + return 0; +} +static inline bool bprm_hit_stack_limit(struct linux_binprm *bprm) +{ +#ifdef CONFIG_MMU + return bprm->p < bprm->argmin; +#else + return false; +#endif +} + /* * Calculate bprm->argmin from: * - _STK_LIM @@ -532,8 +549,7 @@ static int bprm_stack_limits(struct linux_binprm *bprm) return -E2BIG; limit -= ptr_size; - bprm->argmin = bprm->p - limit; - return 0; + return bprm_set_stack_limit(bprm, limit); } /* @@ -571,10 +587,8 @@ static int copy_strings(int argc, struct user_arg_ptr argv, pos = bprm->p; str += len; bprm->p -= len; -#ifdef CONFIG_MMU - if (bprm->p < bprm->argmin) + if (bprm_hit_stack_limit(bprm)) goto out; -#endif while (len > 0) { int offset, bytes_to_copy; @@ -649,7 +663,7 @@ int copy_string_kernel(const char *arg, struct linux_binprm *bprm) /* We're going to work our way backwards. */ arg += len; bprm->p -= len; - if (IS_ENABLED(CONFIG_MMU) && bprm->p < bprm->argmin) + if (bprm_hit_stack_limit(bprm)) return -E2BIG; while (len > 0) { diff --git a/fs/exec_test.c b/fs/exec_test.c index 32a90c6f47e7..8fea0bf0b7f5 100644 --- a/fs/exec_test.c +++ b/fs/exec_test.c @@ -96,7 +96,9 @@ static void exec_test_bprm_stack_limits(struct kunit *test) rc = bprm_stack_limits(&bprm); KUNIT_EXPECT_EQ_MSG(test, rc, result->expected_rc, "on loop %d", i); +#ifdef CONFIG_MMU KUNIT_EXPECT_EQ_MSG(test, bprm.argmin, result->expected_argmin, "on loop %d", i); +#endif } } diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h index 70f97f685bff..e6c00e860951 100644 --- a/include/linux/binfmts.h +++ b/include/linux/binfmts.h @@ -19,13 +19,13 @@ struct linux_binprm { #ifdef CONFIG_MMU struct vm_area_struct *vma; unsigned long vma_pages; + unsigned long argmin; /* rlimit marker for copy_strings() */ #else # define MAX_ARG_PAGES 32 struct page *page[MAX_ARG_PAGES]; #endif struct mm_struct *mm; unsigned long p; /* current top of mem */ - unsigned long argmin; /* rlimit marker for copy_strings() */ unsigned int /* Should an execfd be passed to userspace? */ have_execfd:1, From patchwork Fri Jun 21 20:50:44 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13708056 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id F412FC2BD05 for ; Fri, 21 Jun 2024 20:50:51 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7110B8D01A3; Fri, 21 Jun 2024 16:50:51 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 6BD5F6B0483; Fri, 21 Jun 2024 16:50:51 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 427978D01A3; Fri, 21 Jun 2024 16:50:51 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 149AD6B0481 for ; Fri, 21 Jun 2024 16:50:51 -0400 (EDT) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 9A5E341175 for ; Fri, 21 Jun 2024 20:50:50 +0000 (UTC) X-FDA: 82256089860.03.D1E3720 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf21.hostedemail.com (Postfix) with ESMTP id D7F1E1C0011 for ; Fri, 21 Jun 2024 20:50:47 +0000 (UTC) Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=RAkDBFKV; spf=pass (imf21.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1719003042; a=rsa-sha256; cv=none; b=udh74b3v/xrPopVp/XElU8pnVPqyykGJuQRtF3311smvHe2EQoKugQtrOO0240qnJCOFPq gyZFI6M14X0YOrhI6EdYeEM7l0eM9LZdSlc+L9jMRk4h1yG7GUxhaJ39yhNpNtulxELRLl K5HcqTbdsQFHcClpfpRvTtH2JT4n92c= ARC-Authentication-Results: i=1; imf21.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=RAkDBFKV; spf=pass (imf21.hostedemail.com: domain of kees@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=kees@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1719003042; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=pA7daRdQniOMjkiPc77YRr09QZiN/uZk6ltYOmeI71U=; b=oetXdp/e+Wfaw/b7l3wNjrelJDePJAOUgAj2s6cklAM1LHr1G/JcrYo0ZSTIWsUiusnEAB 3zBtfYi0X776cGUmKeP99d6k4Yf0Gbfbp7Q45D0jq0iV9NLjM6ADDdBj4Bur05Hc63WBKC HKA6po+uOGrLDlxfzWL2T5WVSoaVCbI= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 37B7D62386; Fri, 21 Jun 2024 20:50:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9F68DC4AF09; Fri, 21 Jun 2024 20:50:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1719003046; bh=HGKiztfmnXGwe57zj0+vTZfhNT7KQZ5JNN+BGrOb5Qw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RAkDBFKVl8xmtb2DHIPOV2tWg9gbzOL1odQSCGDEXJNPgM0WUxIxBe87GtqqWJ+4A 1Ere96aP9tXLhWixhIZSvQheDU5VDOtlYZ7/DpmebD/f4Tp0apl4GBwQ0utpvwApMh KAeYFQUGf8tbr+xiQDD/fo3hDTyV18sQydUOi+eZsvrNA+K2MSdVQdGwKJLzt7ejma e3onkPPrABfNag37HD3ojtklzAwWmw5WQ/6vezXvCejKws996+3d20U3Ir7nxeBm4w kXP35UpmP8mmSxdjYJpGQhw+KveCa+Jz9gCAWSOsOHo7XrHNY/Nb/jhTL1PYPx5LyR LdVoE6OLcFbCg== From: Kees Cook To: Guenter Roeck Cc: Kees Cook , Eric Biederman , Justin Stitt , Alexander Viro , Christian Brauner , Jan Kara , linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, Alexey Dobriyan , Laurent Vivier , Lukas Bulwahn , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 2/2] exec: Avoid pathological argc, envc, and bprm->p values Date: Fri, 21 Jun 2024 13:50:44 -0700 Message-Id: <20240621205046.4001362-2-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240621204729.it.434-kees@kernel.org> References: <20240621204729.it.434-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4831; i=kees@kernel.org; h=from:subject; bh=HGKiztfmnXGwe57zj0+vTZfhNT7KQZ5JNN+BGrOb5Qw=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBmdeekLPmeDCyHBRB+FOlnbPUxLBpaNJ4ss73+0 bFmZEGvDfSJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZnXnpAAKCRCJcvTf3G3A JrHpEACwK/KoxBiuYpyBhT1faCVPtic/WRxA+xyHpVQqTf6/yL7eoyTCaiJk58mIoXAOB1tXoq1 89j9SqoxNE/uRUHLli/HOj4QYrwLyzyr6XqxRj2hwij6HLNf9poM46hOJ/Zz5tgjL9EPkZDam3/ 7aK6+OHKWEWWqqlzQhmmla+vhcKlA8MMZ2t1InXPiiXw/htTp52e2IHC0W0q4rubg+6sihRa36e Ov/Pa6O58b1fG2Ik8GcjDXlBSTj3uaTNcSZOxvZg10WpPs5r2y01iBcT+N3IHSJUFmFWpiksvKT btcLB7+7FHVBvjMKcTSA9+5TytPgMiyVMN78mKTyEfkJEjWE7GRAbeVWYTPGR0giV+lV4WJ/JJK ovljU3VUetF/2fEn8Dpr8cXSNetg15795IqzDIgO0A6FDrGGHkkXF/+q0yk3Q3JMGliylAZitXC 40+5rkqqddWDwsVg+qkKqsJrx5ttQXSi+EpAhDb62nFUtbmuznNzMEwVJgfykpWhhHMsuad13G9 DKiPCY7OeiiKNbXjfgkXID2BkHtEj1kJRD6fEVkiFuDBzqD6qWDhwLCS/mv4q5u9hLpGs68pywr ivAMmlI7v7KA3pttOS+oPQea7JkKuqHV096jHTtskEhpy9PH9bGkfGeC2PLQuBjKAZ2VF2FT6Wx jsCjqkqW7b/2erQ= = X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Stat-Signature: 11pd3x4yct4bwo4k6kj1bzm1t9rsx4si X-Rspamd-Queue-Id: D7F1E1C0011 X-Rspam-User: X-Rspamd-Server: rspam10 X-HE-Tag: 1719003047-224440 X-HE-Meta: U2FsdGVkX183VOYdy5lqfKvY5p8U1bYLLQerd/Yuv4VsZkaHBsx+2/jh/btniHxdT6I8GP1VvhEpGypIMKOUGMmyOlRtCDVcmT/u++wX/32rX4ILJZR+WqqjbIpj7n3dTVc0OG3gQPjsfdly6YqaMMnJ47BLbhKTij/lBrGPItugqWd/BC9KvlXGsOS+XkfzSLZZYzlz+7eWE/scr1z9iI1+1fqfIdcc/GqNjiKmhJdA8RKSfKVRdtjq8aleyNymG5mDHiJtTQizICjQuMyG1eW+tjnHNkCgLZohMCw02wluSNCpwm1J+NEJ5wrgctR14u/9EruOy1FDO531vAWA+gazu80aX76L5fIaneNfXE+9wRYYlHUx31U0hI+0cB1/yPOL3NGWPFDDgBo73abu2whYG+jqG5VQFyUo5clC5GEXAfq1JnJiZ246LUYaysFYh39fgg7bgu+jD0TnoffyeyG0m6YzuDgRMXS3+HKZxW0EshMmAevcTifiAdARJE8fBGXE1EHIBMYb/lwLz6d/GorduriBqgNSu2+vYGpdWRZM5hUJ1g2CAbyl+FFmijLanXOTWIuUZoFnd4w1zjBfo2eXUrw5CYsPj5pLSVJSIP78OZ2ZCL6/28kpPEqZbNtFPeBvRySQZ5f64z0nCvcvd27wh0Jn7KAkSExNQ15R7xz8SJQnqjNlMfnUFkb0Y8d6NyMw8jnkcp/pyjHlxOd2vXzXLb7T7wFx2PlChwYcsC7wZxU6Leb12ujFEkl00HfmCpQlnYKKWtal9R75a/AsJrVuygCNb0fbi5om3PqA/oMr70GrjcQuwrFTfH0ZAj9PbROlfHoe3vhzqO1d9f5ovFHBUang80WLD9uIMwxfwyo3RlTnVcg8OljzOjWV+refp7SbwQW5GJWeWEH8WAOD6obVRma1vNVq48vIlTZV/paNrGyJ4gRIgCK9JMUBpXByLmeEEYF6R/+/EfEkPrP 2y0QsXj+ oa2e0JIY5EprJOJlmuucDFd0EQ9y8b+gUwYr2CvMQHkfdXUENpTt9cPxnWnYtS3cxzL9rzXBqs+KTlQyhvTAfZqgO2xZHNQ4Y8Wy1uihQccUNxEBJqHkDmvTlgyqmCEFTb1NCAurZvAKrLnw/skPnWQEhByUtORDOOKJS13LexK2lKJtbOZEgA0GObeQ5TgNmauiwiRPQMg+isqDoTE9PUnOQ17DoMea+ES9RJmy/Oi8ZZHs+Cq13bM0242qqiVWXXezTDzhoIqYLtOaBFtLJ1e1jIiUwp2VpDHx7skspDnJ2w7366YCfVuXAnnE4912zYBHhe5cOUioX6pEEX+f/KJm5GVfsvtkWCGuK+NJXkZlUXe8AWUbjXEnzOmiP3Rvsy3bWaL8pu3tWw5PTIlljyLwcg9ERVBrPL3BBJAjRowVnK1YtblFe1jakEk4G1jj7rp+zfT2MUT6ZRdgE52K/pwXh3Ko1uz193vhAooji6pH4dozcUOwRhUOngIpd84iGmcHZYmWB59l6akAoLnDDceyo2NWCud97LkgGF4DfIV3tvRFkv9H8Lp1k0HoV+Mo8g+LuDweywy4oIihMgfRKFN8UjxgEJJmwu59pTK3UIVUyboWy2vOY0/L5peHQBTe19mQ5 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Make sure nothing goes wrong with the string counters or the bprm's belief about the stack pointer. Add checks and matching self-tests. Take special care for !CONFIG_MMU, since argmin is not exposed there. For 32-bit validation, 32-bit UML was used: $ tools/testing/kunit/kunit.py run \ --make_options CROSS_COMPILE=i686-linux-gnu- \ --make_options SUBARCH=i386 \ exec For !MMU validation, m68k was used: $ tools/testing/kunit/kunit.py run \ --arch m68k --make_option CROSS_COMPILE=m68k-linux-gnu- \ exec Link: https://lore.kernel.org/r/20240520021615.741800-2-keescook@chromium.org Signed-off-by: Kees Cook --- Cc: Guenter Roeck Cc: Eric Biederman Cc: Justin Stitt Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Cc: linux-fsdevel@vger.kernel.org Cc: linux-mm@kvack.org --- fs/exec.c | 10 +++++++++- fs/exec_test.c | 28 +++++++++++++++++++++++++++- 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index b7bc63bfb907..5b580ff8d955 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -490,6 +490,9 @@ static inline int bprm_set_stack_limit(struct linux_binprm *bprm, unsigned long limit) { #ifdef CONFIG_MMU + /* Avoid a pathological bprm->p. */ + if (bprm->p < limit) + return -E2BIG; bprm->argmin = bprm->p - limit; #endif return 0; @@ -531,6 +534,9 @@ static int bprm_stack_limits(struct linux_binprm *bprm) * of argument strings even with small stacks */ limit = max_t(unsigned long, limit, ARG_MAX); + /* Reject totally pathological counts. */ + if (bprm->argc < 0 || bprm->envc < 0) + return -E2BIG; /* * We must account for the size of all the argv and envp pointers to * the argv and envp strings, since they will also take up space in @@ -544,7 +550,9 @@ static int bprm_stack_limits(struct linux_binprm *bprm) * argc can never be 0, to keep them from walking envp by accident. * See do_execveat_common(). */ - ptr_size = (max(bprm->argc, 1) + bprm->envc) * sizeof(void *); + if (check_add_overflow(max(bprm->argc, 1), bprm->envc, &ptr_size) || + check_mul_overflow(ptr_size, sizeof(void *), &ptr_size)) + return -E2BIG; if (limit <= ptr_size) return -E2BIG; limit -= ptr_size; diff --git a/fs/exec_test.c b/fs/exec_test.c index 8fea0bf0b7f5..7c77d039680b 100644 --- a/fs/exec_test.c +++ b/fs/exec_test.c @@ -8,9 +8,34 @@ struct bprm_stack_limits_result { }; static const struct bprm_stack_limits_result bprm_stack_limits_results[] = { - /* Giant values produce -E2BIG */ + /* Negative argc/envc counts produce -E2BIG */ + { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX, + .argc = INT_MIN, .envc = INT_MIN }, .expected_rc = -E2BIG }, + { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX, + .argc = 5, .envc = -1 }, .expected_rc = -E2BIG }, + { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX, + .argc = -1, .envc = 10 }, .expected_rc = -E2BIG }, + /* The max value of argc or envc is MAX_ARG_STRINGS. */ { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX, .argc = INT_MAX, .envc = INT_MAX }, .expected_rc = -E2BIG }, + { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX, + .argc = MAX_ARG_STRINGS, .envc = MAX_ARG_STRINGS }, .expected_rc = -E2BIG }, + { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX, + .argc = 0, .envc = MAX_ARG_STRINGS }, .expected_rc = -E2BIG }, + { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX, + .argc = MAX_ARG_STRINGS, .envc = 0 }, .expected_rc = -E2BIG }, + /* + * On 32-bit system these argc and envc counts, while likely impossible + * to represent within the associated TASK_SIZE, could overflow the + * limit calculation, and bypass the ptr_size <= limit check. + */ + { { .p = ULONG_MAX, .rlim_stack.rlim_cur = ULONG_MAX, + .argc = 0x20000001, .envc = 0x20000001 }, .expected_rc = -E2BIG }, +#ifdef CONFIG_MMU + /* Make sure a pathological bprm->p doesn't cause an overflow. */ + { { .p = sizeof(void *), .rlim_stack.rlim_cur = ULONG_MAX, + .argc = 10, .envc = 10 }, .expected_rc = -E2BIG }, +#endif /* * 0 rlim_stack will get raised to ARG_MAX. With 1 string pointer, * we should see p - ARG_MAX + sizeof(void *). @@ -88,6 +113,7 @@ static void exec_test_bprm_stack_limits(struct kunit *test) /* Double-check the constants. */ KUNIT_EXPECT_EQ(test, _STK_LIM, SZ_8M); KUNIT_EXPECT_EQ(test, ARG_MAX, 32 * SZ_4K); + KUNIT_EXPECT_EQ(test, MAX_ARG_STRINGS, 0x7FFFFFFF); for (int i = 0; i < ARRAY_SIZE(bprm_stack_limits_results); i++) { const struct bprm_stack_limits_result *result = &bprm_stack_limits_results[i];