On Thu, Sep 26, 2019 at 08:26:12PM +0200, Richard Kojedzinszky wrote: > Thanks for the quick patch. It seems my binaries start up well, and work as > expected, as before. > > Thanks again for the quick response.
Awesome; thanks for the testing (and sorry for the breakage)! :) -Kees > > Regards, > Richard Kojedzinszky > > 2019-09-26 19:15 időpontban Kees Cook ezt írta: > > When brk was moved for binaries without an interpreter, it should have > > been limited to ET_DYN only. In other words, the special case was an > > ET_DYN that lacks an INTERP, not just an executable that lacks INTERP. > > The bug manifested for giant static executables, where the brk would end > > up in the middle of the text area on 32-bit architectures. > > > > Reported-by: Richard Kojedzinszky <[email protected]> > > Fixes: bbdc6076d2e5 ("binfmt_elf: move brk out of mmap when doing > > direct loader exec") > > Cc: [email protected] > > Signed-off-by: Kees Cook <[email protected]> > > --- > > Richard, are you able to test this? I'm able to run the gitea binary > > with this change, and my INTERP-less ET_DYN tests (from the original > > bug) continue to pass as well. > > --- > > fs/binfmt_elf.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c > > index cec3b4146440..ad4c6b1d5074 100644 > > --- a/fs/binfmt_elf.c > > +++ b/fs/binfmt_elf.c > > @@ -1121,7 +1121,8 @@ static int load_elf_binary(struct linux_binprm > > *bprm) > > * (since it grows up, and may collide early with the stack > > * growing down), and into the unused ELF_ET_DYN_BASE region. > > */ > > - if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) && !interpreter) > > + if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) && > > + loc->elf_ex.e_type == ET_DYN && !interpreter) > > current->mm->brk = current->mm->start_brk = > > ELF_ET_DYN_BASE; > > > > -- > > 2.17.1 -- Kees Cook
