binfmt_elf: Use elf_load() for interpreter

Handle arbitrary memsz>filesz in interpreter ELF segments, instead of
only supporting it in the last segment (which is expected to be the
BSS).

Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-mm@kvack.org
Reported-by: Pedro Falcato <pedro.falcato@gmail.com>
Closes: https://lore.kernel.org/lkml/20221106021657.1145519-1-pedro.falcato@gmail.com/
Tested-by: Pedro Falcato <pedro.falcato@gmail.com>
Signed-off-by: Sebastian Ott <sebott@redhat.com>
Link: https://lore.kernel.org/r/20230929032435.2391507-3-keescook@chromium.org
Signed-off-by: Kees Cook <keescook@chromium.org>

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 0214d5a949fcd2cc205af6c9eaed98090a3df1fe..db47cb802f8919b3bfedafc626f42d5a5de946c7 100644 (file)
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -622,8 +622,6 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
        struct elf_phdr *eppnt;
        unsigned long load_addr = 0;
        int load_addr_set = 0;
-       unsigned long last_bss = 0, elf_bss = 0;
-       int bss_prot = 0;
        unsigned long error = ~0UL;
        unsigned long total_size;
        int i;
@@ -660,7 +658,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
                        else if (no_base && interp_elf_ex->e_type == ET_DYN)
                                load_addr = -vaddr;
 
-                       map_addr = elf_map(interpreter, load_addr + vaddr,
+                       map_addr = elf_load(interpreter, load_addr + vaddr,
                                        eppnt, elf_prot, elf_type, total_size);
                        total_size = 0;
                        error = map_addr;
@@ -686,51 +684,9 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
                                error = -ENOMEM;
                                goto out;
                        }
-
-                       /*
-                        * Find the end of the file mapping for this phdr, and
-                        * keep track of the largest address we see for this.
-                        */
-                       k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
-                       if (k > elf_bss)
-                               elf_bss = k;
-
-                       /*
-                        * Do the same thing for the memory mapping - between
-                        * elf_bss and last_bss is the bss section.
-                        */
-                       k = load_addr + eppnt->p_vaddr + eppnt->p_memsz;
-                       if (k > last_bss) {
-                               last_bss = k;
-                               bss_prot = elf_prot;
-                       }
                }
        }
 
-       /*
-        * Now fill out the bss section: first pad the last page from
-        * the file up to the page boundary, and zero it from elf_bss
-        * up to the end of the page.
-        */
-       if (padzero(elf_bss)) {
-               error = -EFAULT;
-               goto out;
-       }
-       /*
-        * Next, align both the file and mem bss up to the page size,
-        * since this is where elf_bss was just zeroed up to, and where
-        * last_bss will end after the vm_brk_flags() below.
-        */
-       elf_bss = ELF_PAGEALIGN(elf_bss);
-       last_bss = ELF_PAGEALIGN(last_bss);
-       /* Finally, if there is still more bss to allocate, do it. */
-       if (last_bss > elf_bss) {
-               error = vm_brk_flags(elf_bss, last_bss - elf_bss,
-                               bss_prot & PROT_EXEC ? VM_EXEC : 0);
-               if (error)
-                       goto out;
-       }
-
        error = load_addr;
 out:
        return error;