From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 7248A8017D for ; Wed, 14 Oct 2026 17:05:20 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69EH41t7001073; Wed, 14 Oct 2026 20:04:02 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69EH41t7001073 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="Z5BfV/57" Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69EH3seH001055 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 14 Oct 2026 20:03:54 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69EH3seH001055 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-48b008137d8so3882295f8f.0 for ; Wed, 14 Oct 2026 10:03:54 -0700 (PDT) X-Gm-Message-State: AFq9FYILkmu97fhLXEy8kmyrOeLXygX2KhuO5rDDM1nVt/tEzmIpVg2m vz7OOJN/ifelC8mNRsPMEFgQvQz7AQWkcVMK20vXnCc5SAXTM92RhVrwlGW5Gg6qkL3+cvNiMml p0YX56tf71eTzHXEwZZ/dL/jSN5t6vHIn4HcbahylghQinElLAtIhUg== X-Gm-Gg: AYBFou07e/9EVWHsKyzwOfAxogy6Mrxo/iYa2V5h+PGshKNaeJdHuKNWRq7Q4ahl0nt /t+9qvqkTEl/Vf15EL4jvYuFw8+HhtSWHcANZwzZYxruMUFdU5HQph5eWhca9HjmAOzjKca6yJE FseYI/105fcaIMVwDGty9WuOdHP9Tx/rh+3MUfXKG3PShxiYjrQsS5b9f/lxdYmnj8KJN1+d3i2 ic3GGj3TVP2vIFRU012kfQYSlzbeGH7uw0ivIelMQzoPiMNfnAPDn75YuC9DwCH0pyPEr9o6+Qe WWLNK5w4ZcX/gpD4DbTeQlUj3Fzb0/Wv7B6IqGm3uVHKK3AqBumIsJg7U9fenz5hWPI+ynmVN8v 1EFvW4gmW4l538lPRHA== X-Received: by 2002:a05:6000:438a:b0:48d:ed2e:6f3a with SMTP id ffacd0b85a97d-48ded2e6ff8mr4410987f8f.5.1791997433709; Wed, 14 Oct 2026 10:03:53 -0700 (PDT) X-Received: by 2002:a05:6000:438a:b0:48d:ed2e:6f3a with SMTP id ffacd0b85a97d-48ded2e6ff8mr4410908f8f.5.1791997433007; Wed, 14 Oct 2026 10:03:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791997433; cv=none; d=google.com; s=arc-20260327; b=GJDFEwQw33se+Vr/+/eHSru13hTwpGkUESsSKTIuSkZ15M/Twe4omJqoQtQAJ9P+sE rn6mow69Yi7DDtLhEDBxr1HWypTd6UWJIAdfiPfvAQ0PgzKqqrvRZsZmIoUQmcK84UTi nLLG9gR95bpO51ablT7m2IjY234bcAf6UxfbbgV+5koHCt53pScfTzZxFR99jmAYe/CP tDn7PWWMOo4BBYeMCFX7OLxNtfsd4ItaOAxI+extZzxnrjXqfu+2a+Hokevi6bocKlax 5bQhqvjZGn3pbPNrop6TOAnVV4Hlda+TqUBnBsNJMSO5+fhCe4gKwN9ODHDJdUe/Y6Q6 VWpQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=hiftDklspjY6n58WPpOH90IBtWPgy7EvxQIdpw6fpRo=; fh=xUcS46XhSaUOWFT7CPWNuABJ4EJ7/+S5u4N+e+rlWN4=; b=GNcw/ttlA0fY+NWQlBDHe+OhIagcPRHvee8WShO8eCgbmuUymSu9SThU2np8ji/Dk6 aMYCJrBhoYa259aNEoq6K+r/2Bz06RsbGEY28cRVjStlQoEcqLLAdjeKgM7vZShkk7Rc Prz9dSsbYNqzA+SstvdEA7o7KuDmgL4b5XOFtJ0k1aZ2/ZBjlgnjBIgipKEFzsUjdp4R YtHDNVS30PF/cyemNiZVBDiluJeIAs+zuf62reFx3+yvjASs4kF3gmbDAlSK7rK98h2J hghj2LTTJI18Plk93YgNJQhnZrJ2Dmo3+FewTyj3NPdpCBzNQGnikE6YITcqLOBkqjvi CxQQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b="Z5BfV/57"; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48de0c063bbsi12686144f8f.374.2026.10.14.10.03.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 10:03:52 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b="Z5BfV/57"; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=hiftDklspjY6n58WPpOH90IBtWPgy7EvxQIdpw6fpRo=; b=Z5BfV/572h+t7Pl5AuP 5oFS0r8sWdoc/CjyHhpnDbN0tCOGNu/z4WhwD1yt7L37/hCMly8zgaVjfOQ06OE/+qBlP399kovGe ZnRgmti4e2Ia+lm1oi/X9LvtkgH/XrObyHidKqc9yOD4sXD2b/mX1bka6Rzyd9ax5KfawBsymns0U 25s+QzaAWyclhH7t4yBLT4i3NEOhALZkG/TNF1CgpcXz01WOMvYG4igLdj67kv5wxl4upnP6LDy71 JdVtg4pyJKCjjlujSWk2hQSgJqN/+4JC1wusa8ErYVg/NJ89XKydRW4tDkvn8SzW+nB9zdUrEmMuD UXVyM3LYHERt5Ag==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xH2Kx-007syU-1u; Wed, 14 Oct 2026 19:03:51 +0200 From: Konstantin Khorenko Date: Wed, 14 Oct 2026 19:03:20 +0200 MIME-Version: 1.0 Message-Id: <20261014-b4-prep-khorenko-vstor-149847-1-upstream-fixes-v1-2-7fde9ffbebe9@virtuozzo.com> References: <20261014-b4-prep-khorenko-vstor-149847-1-upstream-fixes-v1-0-7fde9ffbebe9@virtuozzo.com> In-Reply-To: <20261014-b4-prep-khorenko-vstor-149847-1-upstream-fixes-v1-0-7fde9ffbebe9@virtuozzo.com> To: Pavel Tikhomirov , Andrey Drobyshev , Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4798; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=5tY/i33Tx83c7PY+dj+LyWgZS/ymvwkGzkX+uVbkFz4=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqz7X3/Gm3FEZCXX8FU5uMMNFhBauTrvxJtt/Se zfEILuGmNaJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCas+19wAKCRBRlgpH+WFc KrhIEACb+7YipJB0X0qaZ7GKkAa+Bc/rMvQ4svdnBC65wYarc9nxvFuNj3FpjLqJORxagpP9zvY DnCkiUS2KT3XkmoIcwriswuzNMryS2X08B/zI9v1wkwxAW7JWIVF4AVj3PyxMAB437brSgqxpBW Yim+PoH+yclX1DejBhMdwUod49SPOYulztBcwBCyf+2cKE6/MpoRQll7dDHmAfrq/Yo74/UDpIr beW6HZFhgtQ6vUR0BZlRV63lYw8iMfgFSsyoAbJELAf7vDPzwm0Qfwq0kjzEQiVhgHqm571d5HP hlRbU6jlwX4SXcHY/nPOII8Fe8buECZY+o7gFTv8S72MwRpNXSnEulmehkKvorMeLDp2UHwOMez ClnYxV4Yhkel6zNuJ3BTCXGGEKIvwhgake1jTfAiREwmp+FXoBywlL/GGNi6R+mluD7kyw41p+k 8jvpeeRLbdjBz47jaAfcZVNlYA6SRRr66qimagUcRiBDJ34x1LgPOHxjqPJwE9Vgw4on2mxbLVj NxiznxMWO3qpmBxbu25EArg4Tpwow8Lv+ldBBab/P99h4P7j7RRLsIMkAo3Ir580AiTgzi25b+h YeXRhYI7pRCcjnGC9sXeUDKGLiB0dtWO4AWUSRGOM8fBe3I6cTzH6P2HmzI5ArT6TPGlPLAIU8U /LmmF3Pi23HMKbw== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 2/2] binfmt_elf: return the real error when program headers cannot be loaded X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org load_elf_phdrs() returns NULL on any failure, and load_elf_binary() turns that into -ENOEXEC for the executable and -ELIBBAD for its interpreter. So a failed allocation or read of the program headers makes glibc's execvp() run the ELF file with /bin/sh, and reports a healthy ld.so as a corrupted shared library. Return an ERR_PTR instead, as binfmt_elf_fdpic does: -ENOEXEC bad e_phentsize, e_phnum or e_phoff, or the file ends before the header table -ENOMEM the allocation fails read error kernel_read() fails Malformed files keep getting -ENOEXEC and -ELIBBAD. kernel_read() returns a short count when a later page fails, so read on until the error or the end of the file shows. An e_phoff past LLONG_MAX - size is rejected up front, as rw_verify_area() would turn it into -EINVAL. Backport note: the same patch is prepared for mainline. The v6.17 change "binfmt_elf: remove the 4k limitation of program header size" is not in this tree, so the header table is still limited to ELF_MIN_ALIGN and the allocation in practice fails only under fault injection; the read errors and the e_phoff check apply as they are. Fixes: 6a8d38945cf4 ("binfmt_elf: Hoist ELF program header loading to a function") Fixes: a9d9ef133f44 ("binfmt_elf: load interpreter program headers earlier") https://virtuozzo.atlassian.net/browse/VSTOR-150144 Feature: fix ms/exec Assisted-by: LLM Signed-off-by: Konstantin Khorenko --- fs/binfmt_elf.c | 51 +++++++++++++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 18 deletions(-) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 9190e5204152a..a5689a2844d43 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -512,39 +512,48 @@ static unsigned long maximum_alignment(struct elf_phdr *cmds, int nr) * * Loads ELF program headers from the binary file elf_file, which has the ELF * header pointed to by elf_ex, into a newly allocated array. The caller is - * responsible for freeing the allocated data. Returns NULL upon failure. + * responsible for freeing the allocated data. Returns an ERR_PTR upon failure: + * -ENOEXEC for a malformed header or when the read reaches the end of the + * file, the allocation or read error otherwise. */ static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex, struct file *elf_file) { - struct elf_phdr *elf_phdata = NULL; - int retval = -1; - unsigned int size; + struct elf_phdr *elf_phdata; + unsigned int size, done; + loff_t pos; + ssize_t rv; /* * If the size of this structure has changed, then punt, since * we will be doing the wrong thing. */ if (elf_ex->e_phentsize != sizeof(struct elf_phdr)) - goto out; + return ERR_PTR(-ENOEXEC); /* Sanity check the number of program headers... */ - /* ...and their total size. */ + /* ...their total size and their offset. */ size = sizeof(struct elf_phdr) * elf_ex->e_phnum; - if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN) - goto out; + if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN || + elf_ex->e_phoff > LLONG_MAX - size) + return ERR_PTR(-ENOEXEC); elf_phdata = kmalloc(size, GFP_KERNEL); if (!elf_phdata) - goto out; - - /* Read in the program headers */ - retval = elf_read(elf_file, elf_phdata, size, elf_ex->e_phoff); + return ERR_PTR(-ENOMEM); -out: - if (retval) { - kfree(elf_phdata); - elf_phdata = NULL; + /* + * Read in the program headers. A read that fails part way returns + * what it got, so read on to see the error or the end of the file. + */ + pos = elf_ex->e_phoff; + for (done = 0; done < size; done += rv) { + rv = kernel_read(elf_file, (char *)elf_phdata + done, + size - done, &pos); + if (rv <= 0) { + kfree(elf_phdata); + return ERR_PTR(rv ? rv : -ENOEXEC); + } } return elf_phdata; } @@ -939,8 +948,10 @@ static int load_elf_binary(struct linux_binprm *bprm) goto out; elf_phdata = load_elf_phdrs(elf_ex, bprm->file); - if (!elf_phdata) + if (IS_ERR(elf_phdata)) { + retval = PTR_ERR(elf_phdata); goto out; + } elf_ppnt = elf_phdata; for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) { @@ -1044,8 +1055,12 @@ static int load_elf_binary(struct linux_binprm *bprm) /* Load the interpreter program headers */ interp_elf_phdata = load_elf_phdrs(interp_elf_ex, interpreter); - if (!interp_elf_phdata) + if (IS_ERR(interp_elf_phdata)) { + if (PTR_ERR(interp_elf_phdata) != -ENOEXEC) + retval = PTR_ERR(interp_elf_phdata); + interp_elf_phdata = NULL; goto out_free_dentry; + } /* Pass PT_LOPROC..PT_HIPROC headers to arch code */ elf_property_phdata = NULL; -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel