| Message ID | 20180226154659.10218-2-blackzert@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 02/26/2018 07:46 AM, Ilya Smith wrote: > Signed-off-by: Ilya Smith <blackzert@gmail.com> > --- > fs/binfmt_elf.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 51 insertions(+) > > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c > index bdb201230bae..970b42044240 100644 > --- a/fs/binfmt_elf.c > +++ b/fs/binfmt_elf.c > @@ -524,6 +524,52 @@ static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp, > > #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */ > > +/** > + * elf_check_phdr() - common check ELF program header. > + * @phdr: The program header to check > + * @phdr_num: Count of program headers in @phdr from elf header. > + * > + * Checks ELF binary meets specification. > + * > + * Return: Zero to proceed with ELF load, non-zero to faile the ELF load fail > + * with that return code. > + */ > +static int elf_check_phdr(struct elf_phdr *phdr, unsigned long phdr_num) > +{ And it would be nicer/better to have all of the "intro" text in the body of this message instead of in another email. thanks,
Thanks for that, I will fix it in next patch. Any other feedback? Thanks, Ilya > 26 февр. 2018 г., в 20:48, Randy Dunlap <rdunlap@infradead.org> написал(а): > > On 02/26/2018 07:46 AM, Ilya Smith wrote: >> Signed-off-by: Ilya Smith <blackzert@gmail.com> >> --- >> fs/binfmt_elf.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ >> 1 file changed, 51 insertions(+) >> >> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c >> index bdb201230bae..970b42044240 100644 >> --- a/fs/binfmt_elf.c >> +++ b/fs/binfmt_elf.c >> @@ -524,6 +524,52 @@ static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp, >> >> #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */ >> >> +/** >> + * elf_check_phdr() - common check ELF program header. >> + * @phdr: The program header to check >> + * @phdr_num: Count of program headers in @phdr from elf header. >> + * >> + * Checks ELF binary meets specification. >> + * >> + * Return: Zero to proceed with ELF load, non-zero to faile the ELF load > > fail > >> + * with that return code. >> + */ >> +static int elf_check_phdr(struct elf_phdr *phdr, unsigned long phdr_num) >> +{ > > And it would be nicer/better to have all of the "intro" text in the body of this > message instead of in another email. > > thanks, > -- > ~Randy
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index bdb201230bae..970b42044240 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -524,6 +524,52 @@ static inline int arch_check_elf(struct elfhdr *ehdr, bool has_interp, #endif /* !CONFIG_ARCH_BINFMT_ELF_STATE */ +/** + * elf_check_phdr() - common check ELF program header. + * @phdr: The program header to check + * @phdr_num: Count of program headers in @phdr from elf header. + * + * Checks ELF binary meets specification. + * + * Return: Zero to proceed with ELF load, non-zero to faile the ELF load + * with that return code. + */ +static int elf_check_phdr(struct elf_phdr *phdr, unsigned long phdr_num) +{ + unsigned long i; + struct elf_phdr *eppnt = phdr; + Elf64_Addr curr_vaddr; + Elf64_Xword curr_memsz; + + /* Find first PT_LOAD entry */ + for (i = 0; i < phdr_num && eppnt->p_type != PT_LOAD; ++i, ++eppnt) + ; + + /* no any PT_LOAD */ + if (i == phdr_num) + return -EINVAL; + + curr_memsz = eppnt->p_memsz; + curr_vaddr = eppnt->p_vaddr; + + for (++i, ++eppnt; i < phdr_num; ++i, ++eppnt) { + if (eppnt->p_type != PT_LOAD) + continue; + + /* Check order of vaddr */ + if (eppnt->p_vaddr <= curr_vaddr) + return -EINVAL; + + /* Check overlapping */ + if (eppnt->p_vaddr < curr_vaddr + curr_memsz) + return -EINVAL; + + curr_memsz = eppnt->p_memsz; + curr_vaddr = eppnt->p_vaddr; + } + return 0; +} + /* This is much more generalized than the library routine read function, so we keep this separate. Technically the library read function is only provided so that we can read a.out libraries that have @@ -551,6 +597,8 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, goto out; if (!interpreter->f_op->mmap) goto out; + if (elf_check_phdr(interp_elf_phdata, interp_elf_ex->e_phnum)) + goto out; total_size = total_mapping_size(interp_elf_phdata, interp_elf_ex->e_phnum); @@ -733,6 +781,9 @@ static int load_elf_binary(struct linux_binprm *bprm) if (!elf_phdata) goto out; + if (elf_check_phdr(&loc->elf_ex, loc->elf_ex.e_phnum)) + goto out; + elf_ppnt = elf_phdata; elf_bss = 0; elf_brk = 0;
Signed-off-by: Ilya Smith <blackzert@gmail.com> --- fs/binfmt_elf.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+)