elf: enforce MAP_FIXED on overlaying elf segments
authorMichal Hocko <[email protected]>
Tue, 10 Apr 2018 23:36:05 +0000 (16:36 -0700)
committerLinus Torvalds <[email protected]>
Wed, 11 Apr 2018 17:28:38 +0000 (10:28 -0700)
commitad55eac74f2016c6dc132b9502f794156858a3d1
treeb1d69288fc42ebf5192495b95a47afcb76a3e7a5
parent4ed28639519c7bad5f518e70b3284c6e0763e650
elf: enforce MAP_FIXED on overlaying elf segments

Anshuman has reported that with "fs, elf: drop MAP_FIXED usage from
elf_map" applied, some ELF binaries in his environment fail to start
with

 [   23.423642] 9148 (sed): Uhuuh, elf segment at 0000000010030000 requested but the memory is mapped already
 [   23.423706] requested [1003000010040000] mapped [1003000010040000] 100073 anon

The reason is that the above binary has overlapping elf segments:

  LOAD           0x0000000000000000 0x0000000010000000 0x0000000010000000
                 0x0000000000013a8c 0x0000000000013a8c  R E    10000
  LOAD           0x000000000001fd40 0x000000001002fd40 0x000000001002fd40
                 0x00000000000002c0 0x00000000000005e8  RW     10000
  LOAD           0x0000000000020328 0x0000000010030328 0x0000000010030328
                 0x0000000000000384 0x00000000000094a0  RW     10000

That binary has two RW LOAD segments, the first crosses a page border
into the second

  0x1002fd40 (LOAD2-vaddr) + 0x5e8 (LOAD2-memlen) == 0x10030328 (LOAD3-vaddr)

Handle this situation by enforcing MAP_FIXED when we establish a
temporary brk VMA to handle overlapping segments.  All other mappings
will still use MAP_FIXED_NOREPLACE.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Michal Hocko <[email protected]>
Reported-by: Anshuman Khandual <[email protected]>
Reviewed-by: Khalid Aziz <[email protected]>
Cc: Andrei Vagin <[email protected]>
Cc: Michael Ellerman <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Abdul Haleem <[email protected]>
Cc: Joel Stanley <[email protected]>
Cc: Stephen Rothwell <[email protected]>
Cc: Mark Brown <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
fs/binfmt_elf.c