Re: patch: VFS: fix passing of AT_PHDR value in auxv to ELF interpreter

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, May 07, 2007 at 01:47:02PM -0400, Quentin Godfroy wrote:
> I have made another patch, which I hope should not break anything this
> time. I tested it on an x86_64 kernel with 32 and 64 bits executables,
> PIE and not PIE (well my only PIE are libc-2.5.so and ld-2.5.so). I
> rejoined the loops as suggested, and the kernel falls back on load_addr +
> exec->e_phoff if there was no PT_PHDR entry in the program headers.
> 
> Signed-off-by: Quentin Godfroy <[email protected]>
> ---
> --- linux-2.6.21.1/fs/binfmt_elf.c	2007-05-07 10:58:38.000000000 -0400
> +++ linux-2.6.21.1-patch/fs/binfmt_elf.c	2007-05-07 13:14:33.000000000 -0400
> @@ -134,6 +134,7 @@ static int padzero(unsigned long elf_bss
>  static int
>  create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
>  		int interp_aout, unsigned long load_addr,
> +		unsigned long phdr_addr,
>  		unsigned long interp_load_addr)
>  {
>  	unsigned long p = bprm->p;
> @@ -190,7 +191,10 @@ create_elf_tables(struct linux_binprm *b
>  	NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
>  	NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
>  	NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
> -	NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
> +	if(phdr_addr)
> +		NEW_AUX_ENT(AT_PHDR, phdr_addr);
> +	else
> +		NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
>  	NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
>  	NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
>  	NEW_AUX_ENT(AT_BASE, interp_load_addr);
> @@ -529,7 +533,7 @@ static unsigned long randomize_stack_top
>  static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
>  {
>  	struct file *interpreter = NULL; /* to shut gcc up */
> - 	unsigned long load_addr = 0, load_bias = 0;
> + 	unsigned long load_addr = 0, load_bias = 0, phdr_addr = 0;
>  	int load_addr_set = 0;
>  	char * elf_interpreter = NULL;
>  	unsigned int interpreter_type = INTERPRETER_NONE;
> @@ -620,7 +624,12 @@ static int load_elf_binary(struct linux_
>  	start_data = 0;
>  	end_data = 0;
>  
> -	for (i = 0; i < loc->elf_ex.e_phnum; i++) {
> +	for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
> +		if (elf_ppnt->p_type == PT_PHDR) {
> +			phdr_addr = elf_ppnt->p_vaddr;
> +			continue;
> +		}
> +
>  		if (elf_ppnt->p_type == PT_INTERP) {
>  			/* This is the program interpreter used for
>  			 * shared libraries - for now assume that this
> @@ -703,20 +712,17 @@ static int load_elf_binary(struct linux_
>  			/* Get the exec headers */
>  			loc->interp_ex = *((struct exec *)bprm->buf);
>  			loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
> -			break;
> +			continue;
>  		}
> -		elf_ppnt++;
> -	}
>  
> -	elf_ppnt = elf_phdata;
> -	for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
>  		if (elf_ppnt->p_type == PT_GNU_STACK) {
>  			if (elf_ppnt->p_flags & PF_X)
>  				executable_stack = EXSTACK_ENABLE_X;
>  			else
>  				executable_stack = EXSTACK_DISABLE_X;
> -			break;
> +			continue;
>  		}
> +	}
>  
>  	/* Some simple consistency checks for the interpreter */
>  	if (elf_interpreter) {
> @@ -985,9 +991,12 @@ static int load_elf_binary(struct linux_
>  
>  	compute_creds(bprm);
>  	current->flags &= ~PF_FORKNOEXEC;
> +	if (phdr_addr)
> +		phdr_addr += load_bias;
> +
>  	create_elf_tables(bprm, &loc->elf_ex,
>  			  (interpreter_type == INTERPRETER_AOUT),
> -			  load_addr, interp_load_addr);
> +			  load_addr, phdr_addr, interp_load_addr);
>  	/* N.B. passed_fileno might not be initialized? */
>  	if (interpreter_type == INTERPRETER_AOUT)
>  		current->mm->arg_start += strlen(passed_fileno) + 1;

Wooops. Wrong one. Sorry. This one could have memory leaks.

Signed-off-by: Quentin Godfroy <[email protected]>
---
--- linux-2.6.21.1/fs/binfmt_elf.c	2007-05-07 10:58:38.000000000 -0400
+++ linux-2.6.21.1-patch/fs/binfmt_elf.c	2007-05-07 13:58:14.000000000 -0400
@@ -134,6 +134,7 @@ static int padzero(unsigned long elf_bss
 static int
 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
 		int interp_aout, unsigned long load_addr,
+		unsigned long phdr_addr,
 		unsigned long interp_load_addr)
 {
 	unsigned long p = bprm->p;
@@ -190,7 +191,10 @@ create_elf_tables(struct linux_binprm *b
 	NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
 	NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
 	NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
-	NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
+	if(phdr_addr)
+		NEW_AUX_ENT(AT_PHDR, phdr_addr);
+	else
+		NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
 	NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
 	NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
 	NEW_AUX_ENT(AT_BASE, interp_load_addr);
@@ -529,7 +533,7 @@ static unsigned long randomize_stack_top
 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 {
 	struct file *interpreter = NULL; /* to shut gcc up */
- 	unsigned long load_addr = 0, load_bias = 0;
+ 	unsigned long load_addr = 0, load_bias = 0, phdr_addr = 0;
 	int load_addr_set = 0;
 	char * elf_interpreter = NULL;
 	unsigned int interpreter_type = INTERPRETER_NONE;
@@ -709,14 +713,20 @@ static int load_elf_binary(struct linux_
 	}
 
 	elf_ppnt = elf_phdata;
-	for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
+	for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
+		if (elf_ppnt->p_type == PT_PHDR) {
+			phdr_addr = elf_ppnt->p_vaddr;
+			continue;
+		}
+
 		if (elf_ppnt->p_type == PT_GNU_STACK) {
 			if (elf_ppnt->p_flags & PF_X)
 				executable_stack = EXSTACK_ENABLE_X;
 			else
 				executable_stack = EXSTACK_DISABLE_X;
-			break;
+			continue;
 		}
+	}
 
 	/* Some simple consistency checks for the interpreter */
 	if (elf_interpreter) {
@@ -985,9 +995,12 @@ static int load_elf_binary(struct linux_
 
 	compute_creds(bprm);
 	current->flags &= ~PF_FORKNOEXEC;
+	if (phdr_addr)
+		phdr_addr += load_bias;
+
 	create_elf_tables(bprm, &loc->elf_ex,
 			  (interpreter_type == INTERPRETER_AOUT),
-			  load_addr, interp_load_addr);
+			  load_addr, phdr_addr, interp_load_addr);
 	/* N.B. passed_fileno might not be initialized? */
 	if (interpreter_type == INTERPRETER_AOUT)
 		current->mm->arg_start += strlen(passed_fileno) + 1;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]
  Powered by Linux