On 29/5/19 10:05 pm, Arnd Bergmann wrote:
On Tue, May 28, 2019 at 12:56 PM Greg Ungerer <gerg@xxxxxxxxxxxxxx> wrote:
On 27/5/19 11:38 pm, Jann Horn wrote:
On Sat, May 25, 2019 at 11:43 PM Andrew Morton
<akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
On Fri, 24 May 2019 22:18:17 +0200 Jann Horn <jannh@xxxxxxxxxx> wrote:
load_flat_shared_library() is broken: It only calls load_flat_file() if
prepare_binprm() returns zero, but prepare_binprm() returns the number of
bytes read - so this only happens if the file is empty.
ouch.
Instead, call into load_flat_file() if the number of bytes read is
non-negative. (Even if the number of bytes is zero - in that case,
load_flat_file() will see nullbytes and return a nice -ENOEXEC.)
In addition, remove the code related to bprm creds and stop using
prepare_binprm() - this code is loading a library, not a main executable,
and it only actually uses the members "buf", "file" and "filename" of the
linux_binprm struct. Instead, call kernel_read() directly.
Cc: stable@xxxxxxxxxxxxxxx
Fixes: 287980e49ffc ("remove lots of IS_ERR_VALUE abuses")
Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
---
I only found the bug by looking at the code, I have not verified its
existence at runtime.
Also, this patch is compile-tested only.
It would be nice if someone who works with nommu Linux could have a
look at this patch.
287980e49ffc was three years ago! Has it really been broken for all
that time? If so, it seems a good source of freed disk space...
Maybe... but I didn't want to rip it out without having one of the
maintainers confirm that this really isn't likely to be used anymore.
I have not used shared libraries on m68k non-mmu setups for
a very long time. At least 10 years I would think.
I think Emcraft have a significant customer base running ARM NOMMU
Linux, I wonder whether they would have run into this (adding
Sergei to Cc).
My suspicion is that they use only binfmt-elf-fdpic, not binfmt-flat.
The only architectures I see that enable binfmt-flat are sh, xtensa
and h8300, but only arch/sh uses CONFIG_BINFMT_SHARED_FLAT
m68k uses enables it too. It is the only binary format supported
when running no-mmu on m68k. (You can use it with MMU enabled too
if you really want too).
The shared flat format has been used on m68k in the past (it was
originally developed on m68k platforms). But I haven't used them
for a long time (probably 10 years at least) on m68k.
Regards
Greg
