From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 5EE888125B for ; Wed, 4 Nov 2026 18:07:07 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A4I5sZR025797; Wed, 4 Nov 2026 21:05:55 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A4I5sZR025797 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="a7WpYdcy" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A4I5kId025775 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 4 Nov 2026 21:05:47 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A4I5kId025775 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-48dea677afcso527708f8f.1 for ; Wed, 04 Nov 2026 10:05:46 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBz/rl/+Mux4vajsId3XMN7njB+dkwLy4xsbX1CZWdHBDiIrvZki4Q5P3xKsD7yMqARfLKFsqg==@openvz.org X-Gm-Message-State: APuU4Z+Zf/mUl/iTFQltaU5Bu/WuR/kVnB30wKjjy/3qbGMVywM4IOfd QKse8AEmHY7Xif3JMM4LP8U8AYjJZfSQMNoxQBPmwd8m7/ISK0PMNimLIU4gOQYI2iBxCy3XO21 gWqWuS8a2ripFRiT9n6otezyue2bfJ16AEnZfF64+02AFw5atrAmlqA== X-Gm-Gg: AYBFou0oD+76F9VxTFZCb7nB8SCF3cnGH7+GTr3o0qPcFGNlypYfyNUtnKcNRjdmLYR lb72o1DVNKuxCtpghNjlTKqCg/MtQb66UlacHHaVAAyK/92SI+RSIQyhCFfuJ/XBEs8K6qCD9By McNnZ4WGlmQ33Y9CopEwIIZcgHVJMIUUZDa7+tOiuIkOpvRgjNqaZdqwOa4QrRSdxzOt79mgKtN nbXDtxOfLbPT/32vzbMPkuGb2DQmRW8g4mZMT4TFZmZWebgv+UE3UhSkReVFcK8d1S7mqwc51U/ TxOKpld1nlyUEDUaAXEVuJwSTaax5x5Nn3md/ZAfUmH+rpK2cI9pcvcXWSkH2zhzWcUeJF+uORF aDN9BEnGX8otSneA23A== X-Received: by 2002:a05:6000:2507:b0:48e:643e:de82 with SMTP id ffacd0b85a97d-49115aaca12mr560996f8f.11.1793815546608; Wed, 04 Nov 2026 10:05:46 -0800 (PST) X-Received: by 2002:a05:6000:2507:b0:48e:643e:de82 with SMTP id ffacd0b85a97d-49115aaca12mr560943f8f.11.1793815546080; Wed, 04 Nov 2026 10:05:46 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793815546; cv=none; d=google.com; s=arc-20260327; b=gu5SyAh42oPYBndoDRv/14L45L7itarNXX4EJZBILK9pHxomvyPgWgreLy57qJGrjO 0RZnbG1whdd34QWOVJa9i9yRxyEolyWzviCFeqgoGy/6Dv6ECnzldeTwG0HB3FfS+Geq C3/RAgAmcq2lHCXE0i19N+ni/bu9YcrvdM2GVutuVZw2nzKmdIerJOryI2t1ivhzWS/7 LJQjcuP3xjta+UmbbSEzfGeiNHi8fZTM27umsR3PY7N9R505+vYkFzdF9dmozZDwM2vu QP8PW2C8dMwMLJPPaWDUy6sYqDmhGbZ0BQ005z4LnVTtIPuspUOIcKC42c9MdBow4RdM QDxQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=9I4vdNd/nFRNXAmPc7bhHiP+nuO1kvRNCPsOVWkorsE=; fh=abIpJkmHIgqMVCNUyuYIDt/6GCMqAdsBq4YKsDJk+cQ=; b=dLGYT2OK11t79uDtNIhs3UFwt7VwYII2LJ1yMxteAjtkkCTb61VKnK+QKsGFqSfuXK z6GgzYZCjRKBwZMYCg2SByS0mE+Rc+Ac6ht9U1LLnufrby5VhwHawn7s2VD1RuuvJ7z1 Hcebk3opH00BbOwQs4fCidze4ymv9QrgzSqDGQkSVPUmfOJSfKky0xV1fCMzvLXtJfd/ GUqQGOYyEKwINwX/as6d1fVAJpcMe33LtWjb+0flPdAoOJZ2b5fhLfniAme5/9IfH3/7 tf+wJ8iJQxaoZkBjx+pDp2zix7PTndoKZ3sO8o8pcrN9FhMxX2/kWwz7jkDn56mZLwzC fs9Q==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=a7WpYdcy; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48fed2715a1si4864692f8f.79.2026.11.04.10.05.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 10:05:46 -0800 (PST) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=a7WpYdcy; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=9I4vdNd/nFRNXAmPc7bhHiP+nuO1kvRNCPsOVWkorsE=; b=a7WpYdcyrtvXuA7DC5m QDWKr6JJu7WtIJDkjkSOWPIwopWO6S78DMaqqJbSveT7QcxbHLrU/UHM6dTlhNlHDG/AeyO713v/I 1z5MEZB+Dzu7DPQ/W1pC/mHTgaNbtpT4Mz5gBpOMr43mzSMDvPBSYBPrAh1PskHJqGBOgDTycmNqC hBXrcs0hlRMzDGppnC0MSIcWufABd4a/MrsVW4h0vZiaJZDY3R4sgQS5Kziu4vaOuNeq5wd8D7zNO NvcttuwSVTvGI82M07YLdKPunRfWygLrAmfChsq0vbusw9NYboNVl7oaKhlFLWdxkaQVF4en4jDui 1LGjF4Ug8wjjQzA==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xOfIq-00G4X6-2P; Wed, 04 Nov 2026 19:05:44 +0100 From: Konstantin Khorenko Date: Wed, 04 Nov 2026 19:05:41 +0100 MIME-Version: 1.0 Message-Id: <20261104-b4-prep-khorenko-vstor-149847-1-upstream-fixes-v2-2-2974ec52f0fe@virtuozzo.com> References: <20261104-b4-prep-khorenko-vstor-149847-1-upstream-fixes-v2-0-2974ec52f0fe@virtuozzo.com> In-Reply-To: <20261104-b4-prep-khorenko-vstor-149847-1-upstream-fixes-v2-0-2974ec52f0fe@virtuozzo.com> To: Pavel Tikhomirov , Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4487; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=1hRFKEsVe4+epGzAyuioEwdYJ0/uRW2Vz2pRRWzD5wg=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBq63P4Io/h+AdUAX54PeDzuWG1EeY5hvytqO8nL 9ttSTD8V66JAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCautz+AAKCRBRlgpH+WFc KpggD/0ajmbaxuqNIxxNGEtsSnOxfliPs3pMhzrsTNW1ikRcygFbDNzICP5M4Bsr/hzgaUnS/q/ BMirXtmS46iDqi/+iAuyFiyITyndkkL8JwevGsN1cWQqcc9Gz4vGl+haJSp7gpfgICgN7Uv7+4a hOIQHFv5NQmnSWIa6vI3cm8Ui/inare2UJB1Vb+oYv3EPlJTN10naz42XNR+1W42st0hjrcanMT AHwL3qivON4Sb77II4X6Ro+gZua67oMZ/XHkv0UnlYzTIDK/N2V2xCu5ybkipvL5BiFhIRRek0b FrKZeApHzVw8DEv9kipOaZeF1UDvrCxeU865U4OOy40YdnYxq+SYKA+0ByYSl+1EcWhVrKbVoYg 3Ic2HJrKO0HoZj3hmLQwAKw1N6qbc6mMqJcYkpSDSV8SfrskOKP7BWRUTv7ywv1dPMa2B0tPD1q HjXMvJrOjrdC8k89aHVYnQ9CQ9YfLZmX2aoPGX4G7QJiBnfEpwPVHRx+uB8Z11GUt40WJA5gZ4k sqnf0Yg4R/kiCydDeXtgjsxDRORlaWn5CuM6YyRRad4jCMKCYJHdBkBHzJuJ9tXIritkyHhWdYd LOlvkd57vQBgkCBhZTcUTxisGPEk6OJ5PL6/f/+hEBiKpDMPg5l42smkcd6iAmAKRL2I92EBcV4 QHK2ctm8VxovGvQ== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v2 2/2] binfmt_elf: return the real error when program headers cannot be loaded X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org load_elf_phdrs() returns NULL on any failure, and load_elf_binary() turns that into -ENOEXEC for the executable and -ELIBBAD for its interpreter. So a failed allocation or read of the program headers makes glibc's execvp() run the ELF file with /bin/sh, and reports a healthy ld.so as a corrupted shared library. Return an ERR_PTR instead, as binfmt_elf_fdpic does: -ENOEXEC bad e_phentsize, e_phnum or e_phoff, or a short read -ENOMEM the allocation fails read error kernel_read() fails Malformed files and short reads keep getting -ENOEXEC and -ELIBBAD. The table is read with kernel_read() directly, as elf_read() turns a short read into -EIO. An e_phoff past LLONG_MAX - size is rejected up front, so that rw_verify_area() does not turn it into -EINVAL. Backport note: mainline review asked for a change of the errno only, and this version does just that; a mainline v2 will follow. The v6.17 change "binfmt_elf: remove the 4k limitation of program header size" is not in this tree, so the header table is still limited to ELF_MIN_ALIGN and the allocation in practice fails only under fault injection; the read errors and the e_phoff check apply as they are. Fixes: 6a8d38945cf4 ("binfmt_elf: Hoist ELF program header loading to a function") Fixes: a9d9ef133f44 ("binfmt_elf: load interpreter program headers earlier") https://virtuozzo.atlassian.net/browse/VSTOR-150144 Feature: fix ms/exec Signed-off-by: Konstantin Khorenko --- fs/binfmt_elf.c | 39 ++++++++++++++++++++++++--------------- 1 file changed, 24 insertions(+), 15 deletions(-) diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 9190e5204152a..c39aed19b39d3 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -512,39 +512,42 @@ static unsigned long maximum_alignment(struct elf_phdr *cmds, int nr) * * Loads ELF program headers from the binary file elf_file, which has the ELF * header pointed to by elf_ex, into a newly allocated array. The caller is - * responsible for freeing the allocated data. Returns NULL upon failure. + * responsible for freeing the allocated data. Returns an ERR_PTR upon failure: + * -ENOEXEC for a malformed header or a short read, the allocation or read + * error otherwise. */ static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex, struct file *elf_file) { - struct elf_phdr *elf_phdata = NULL; - int retval = -1; + struct elf_phdr *elf_phdata; unsigned int size; + loff_t pos; + ssize_t rv; /* * If the size of this structure has changed, then punt, since * we will be doing the wrong thing. */ if (elf_ex->e_phentsize != sizeof(struct elf_phdr)) - goto out; + return ERR_PTR(-ENOEXEC); /* Sanity check the number of program headers... */ - /* ...and their total size. */ + /* ...their total size and their offset. */ size = sizeof(struct elf_phdr) * elf_ex->e_phnum; - if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN) - goto out; + if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN || + elf_ex->e_phoff > LLONG_MAX - size) + return ERR_PTR(-ENOEXEC); elf_phdata = kmalloc(size, GFP_KERNEL); if (!elf_phdata) - goto out; + return ERR_PTR(-ENOMEM); /* Read in the program headers */ - retval = elf_read(elf_file, elf_phdata, size, elf_ex->e_phoff); - -out: - if (retval) { + pos = elf_ex->e_phoff; + rv = kernel_read(elf_file, elf_phdata, size, &pos); + if (rv != size) { kfree(elf_phdata); - elf_phdata = NULL; + return ERR_PTR(rv < 0 ? rv : -ENOEXEC); } return elf_phdata; } @@ -939,8 +942,10 @@ static int load_elf_binary(struct linux_binprm *bprm) goto out; elf_phdata = load_elf_phdrs(elf_ex, bprm->file); - if (!elf_phdata) + if (IS_ERR(elf_phdata)) { + retval = PTR_ERR(elf_phdata); goto out; + } elf_ppnt = elf_phdata; for (i = 0; i < elf_ex->e_phnum; i++, elf_ppnt++) { @@ -1044,8 +1049,12 @@ static int load_elf_binary(struct linux_binprm *bprm) /* Load the interpreter program headers */ interp_elf_phdata = load_elf_phdrs(interp_elf_ex, interpreter); - if (!interp_elf_phdata) + if (IS_ERR(interp_elf_phdata)) { + if (PTR_ERR(interp_elf_phdata) != -ENOEXEC) + retval = PTR_ERR(interp_elf_phdata); + interp_elf_phdata = NULL; goto out_free_dentry; + } /* Pass PT_LOPROC..PT_HIPROC headers to arch code */ elf_property_phdata = NULL; -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel