lkml.org 
[lkml]   [2014]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectpowerpc: possible access beyond TASK_SIZE in start_thread
Hi Rusty,

I was looking at the diff between kernel v3.12 and recent master (after 3.13-rc7),
and noticed that in the following commit:

commit 94af3abf995b17f6a008b00152c94841242ec6c7
Author: Rusty Russell <rusty@rustcorp.com.au>
Date: Wed Nov 20 22:15:02 2013 +1100

powerpc: ELF2 binaries launched directly.

on powerpc, those lines appear in start_thread():

+ /* start is a relocated pointer to the function
+ * descriptor for the elf _start routine. The first
+ * entry in the function descriptor is the entry
+ * address of _start and the second entry is the TOC
+ * value we need to use.
+ */
+ __get_user(entry, (unsigned long __user *)start);
+ __get_user(toc, (unsigned long __user *)start+1);

Note the "__" before get_user(), which bypass any kind of validation on the
addresses.

Amongst the callers, if we look at fs/binfmt_elf.c:load_elf_binary(), we see:

elf_entry = loc->elf_ex.e_entry;
if (BAD_ADDR(elf_entry)) {
force_sig(SIGSEGV, current);
retval = -EINVAL;
goto out_free_dentry;
}

and the elf_entry gets passed to start_thread().

If we craft a binary with elf_entry address of

TASK_SIZE - 1 (1 byte before TASK_SIZE), then I think we could make both
__get_user() calls access data beyond TASK_SIZE, because elf_entry address
is verified, but there is no validation on its range AFAIU. Is it expected ?
Am I missing something ?

Thanks,

Mathieu


--
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com


\
 
 \ /
  Last update: 2014-01-10 06:21    [W:1.103 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site