From owner-svn-src-stable-12@freebsd.org Tue May 14 20:26:06 2019 Return-Path: Delivered-To: svn-src-stable-12@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 9D55115979C4; Tue, 14 May 2019 20:26:06 +0000 (UTC) (envelope-from trasz@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4360582EB6; Tue, 14 May 2019 20:26:06 +0000 (UTC) (envelope-from trasz@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 0F7E625FE0; Tue, 14 May 2019 20:26:06 +0000 (UTC) (envelope-from trasz@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id x4EKQ5Qp069024; Tue, 14 May 2019 20:26:05 GMT (envelope-from trasz@FreeBSD.org) Received: (from trasz@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id x4EKQ5Ud069023; Tue, 14 May 2019 20:26:05 GMT (envelope-from trasz@FreeBSD.org) Message-Id: <201905142026.x4EKQ5Ud069023@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: trasz set sender to trasz@FreeBSD.org using -f From: Edward Tomasz Napierala Date: Tue, 14 May 2019 20:26:05 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org Subject: svn commit: r347574 - stable/12/sys/kern X-SVN-Group: stable-12 X-SVN-Commit-Author: trasz X-SVN-Commit-Paths: stable/12/sys/kern X-SVN-Commit-Revision: 347574 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: 4360582EB6 X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.98 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.998,0]; NEURAL_HAM_SHORT(-0.98)[-0.979,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US]; NEURAL_HAM_LONG(-1.00)[-1.000,0] X-BeenThere: svn-src-stable-12@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for only the 12-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 May 2019 20:26:07 -0000 Author: trasz Date: Tue May 14 20:26:05 2019 New Revision: 347574 URL: https://svnweb.freebsd.org/changeset/base/347574 Log: MFC r345661: Factor out retrieving the interpreter path from the main ELF loader routine. MFC r345734 by kib: Fix branding after r345661. In particular, elf32 FreeBSD binaries were not executed on LP64 hosts. The interp_name_len value should account for the nul terminator. This is needed for strncmp()s in brand checking code to work. Sponsored by: DARPA, AFRL Modified: stable/12/sys/kern/imgact_elf.c Directory Properties: stable/12/ (props changed) Modified: stable/12/sys/kern/imgact_elf.c ============================================================================== --- stable/12/sys/kern/imgact_elf.c Tue May 14 20:19:29 2019 (r347573) +++ stable/12/sys/kern/imgact_elf.c Tue May 14 20:26:05 2019 (r347574) @@ -88,7 +88,7 @@ __FBSDID("$FreeBSD$"); static int __elfN(check_header)(const Elf_Ehdr *hdr); static Elf_Brandinfo *__elfN(get_brandinfo)(struct image_params *imgp, - const char *interp, int interp_name_len, int32_t *osrel, uint32_t *fctl0); + const char *interp, int32_t *osrel, uint32_t *fctl0); static int __elfN(load_file)(struct proc *p, const char *file, u_long *addr, u_long *entry); static int __elfN(load_section)(struct image_params *imgp, vm_ooffset_t offset, @@ -273,13 +273,15 @@ __elfN(brand_inuse)(Elf_Brandinfo *entry) static Elf_Brandinfo * __elfN(get_brandinfo)(struct image_params *imgp, const char *interp, - int interp_name_len, int32_t *osrel, uint32_t *fctl0) + int32_t *osrel, uint32_t *fctl0) { const Elf_Ehdr *hdr = (const Elf_Ehdr *)imgp->image_header; Elf_Brandinfo *bi, *bi_m; boolean_t ret; - int i; + int i, interp_name_len; + interp_name_len = interp != NULL ? strlen(interp) + 1 : 0; + /* * We support four types of branding -- (1) the ELF EI_OSABI field * that SCO added to the ELF spec, (2) FreeBSD 3.x's traditional string @@ -890,6 +892,60 @@ __elfN(enforce_limits)(struct image_params *imgp, cons return (0); } +static int +__elfN(get_interp)(struct image_params *imgp, const Elf_Phdr *phdr, + char **interpp, bool *free_interpp) +{ + struct thread *td; + char *interp; + int error, interp_name_len; + + KASSERT(phdr->p_type == PT_INTERP, + ("%s: p_type %u != PT_INTERP", __func__, phdr->p_type)); + KASSERT(VOP_ISLOCKED(imgp->vp), + ("%s: vp %p is not locked", __func__, imgp->vp)); + + td = curthread; + + /* Path to interpreter */ + if (phdr->p_filesz < 2 || phdr->p_filesz > MAXPATHLEN) { + uprintf("Invalid PT_INTERP\n"); + return (ENOEXEC); + } + + interp_name_len = phdr->p_filesz; + if (phdr->p_offset > PAGE_SIZE || + interp_name_len > PAGE_SIZE - phdr->p_offset) { + VOP_UNLOCK(imgp->vp, 0); + interp = malloc(interp_name_len + 1, M_TEMP, M_WAITOK); + vn_lock(imgp->vp, LK_EXCLUSIVE | LK_RETRY); + error = vn_rdwr(UIO_READ, imgp->vp, interp, + interp_name_len, phdr->p_offset, + UIO_SYSSPACE, IO_NODELOCKED, td->td_ucred, + NOCRED, NULL, td); + if (error != 0) { + free(interp, M_TEMP); + uprintf("i/o error PT_INTERP %d\n", error); + return (error); + } + interp[interp_name_len] = '\0'; + + *interpp = interp; + *free_interpp = true; + return (0); + } + + interp = __DECONST(char *, imgp->image_header) + phdr->p_offset; + if (interp[interp_name_len - 1] != '\0') { + uprintf("Invalid PT_INTERP\n"); + return (ENOEXEC); + } + + *interpp = interp; + *free_interpp = false; + return (0); +} + /* * Impossible et_dyn_addr initial value indicating that the real base * must be calculated later with some randomization applied. @@ -906,7 +962,7 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i struct vmspace *vmspace; vm_map_t map; const char *newinterp; - char *interp, *interp_buf, *path; + char *interp, *path; Elf_Brandinfo *brand_info; struct sysentvec *sv; vm_prot_t prot; @@ -914,7 +970,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i u_long maxalign, mapsz, maxv, maxv1; uint32_t fctl0; int32_t osrel; - int error, i, n, interp_name_len, have_interp; + bool free_interp; + int error, i, n, have_interp; hdr = (const Elf_Ehdr *)imgp->image_header; @@ -950,9 +1007,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i osrel = 0; fctl0 = 0; entry = proghdr = 0; - interp_name_len = 0; - newinterp = NULL; - interp = interp_buf = NULL; + newinterp = interp = NULL; + free_interp = false; td = curthread; maxalign = PAGE_SIZE; mapsz = 0; @@ -969,44 +1025,15 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i break; case PT_INTERP: /* Path to interpreter */ - if (phdr[i].p_filesz < 2 || - phdr[i].p_filesz > MAXPATHLEN) { - uprintf("Invalid PT_INTERP\n"); - error = ENOEXEC; - goto ret; - } if (interp != NULL) { uprintf("Multiple PT_INTERP headers\n"); error = ENOEXEC; goto ret; } - interp_name_len = phdr[i].p_filesz; - if (phdr[i].p_offset > PAGE_SIZE || - interp_name_len > PAGE_SIZE - phdr[i].p_offset) { - VOP_UNLOCK(imgp->vp, 0); - interp_buf = malloc(interp_name_len + 1, M_TEMP, - M_WAITOK); - vn_lock(imgp->vp, LK_EXCLUSIVE | LK_RETRY); - error = vn_rdwr(UIO_READ, imgp->vp, interp_buf, - interp_name_len, phdr[i].p_offset, - UIO_SYSSPACE, IO_NODELOCKED, td->td_ucred, - NOCRED, NULL, td); - if (error != 0) { - uprintf("i/o error PT_INTERP %d\n", - error); - goto ret; - } - interp_buf[interp_name_len] = '\0'; - interp = interp_buf; - } else { - interp = __DECONST(char *, imgp->image_header) + - phdr[i].p_offset; - if (interp[interp_name_len - 1] != '\0') { - uprintf("Invalid PT_INTERP\n"); - error = ENOEXEC; - goto ret; - } - } + error = __elfN(get_interp)(imgp, &phdr[i], &interp, + &free_interp); + if (error != 0) + goto ret; break; case PT_GNU_STACK: if (__elfN(nxstack)) @@ -1017,8 +1044,7 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i } } - brand_info = __elfN(get_brandinfo)(imgp, interp, interp_name_len, - &osrel, &fctl0); + brand_info = __elfN(get_brandinfo)(imgp, interp, &osrel, &fctl0); if (brand_info == NULL) { uprintf("ELF binary type \"%u\" not known.\n", hdr->e_ident[EI_OSABI]); @@ -1239,7 +1265,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i imgp->proc->p_elf_flags = hdr->e_flags; ret: - free(interp_buf, M_TEMP); + if (free_interp) + free(interp, M_TEMP); return (error); }