From nobody Sun Dec 19 02:44:28 2021 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id F12F518E4AC9; Sun, 19 Dec 2021 02:44:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4JGn9m2qH9z4qGX; Sun, 19 Dec 2021 02:44:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 267B81ADAD; Sun, 19 Dec 2021 02:44:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 1BJ2iSrm012590; Sun, 19 Dec 2021 02:44:28 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 1BJ2iSAS012589; Sun, 19 Dec 2021 02:44:28 GMT (envelope-from git) Date: Sun, 19 Dec 2021 02:44:28 GMT Message-Id: <202112190244.1BJ2iSAS012589@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Konstantin Belousov Subject: git: e0dc92e185b2 - stable/13 - elf image activator: convert asserts into errors List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: e0dc92e185b231ceb9c465e35b47e7dad89a3ec8 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1639881868; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uA8+5890tgh4F7+VogZSqBOFTjz6+dyILSLFOO+WL1I=; b=YgRfd1FOrHfwx4eaO/+H9iX41KxW0ZSDH8DE0o61EX2R/js/eP2gj8Shj2EVtXLG9+2S2t r326c/QiuJnOHEkYvB/KE9QbfmXCJjxiCLGlHgTdByXrYiioB2CPqakiJ5fom7/eCVrEsU wV1GdE6Ta2L8sYz4QhRwCqhp42SK9d1kn2EAiYqhrBbTZBWEXASJsfWRFXM8XRzjtadN3I cURTFFvJF0VJLF+MAi4Fmk7zlhvZZs5ZNyzUWBpjPCRaIA0XYpKNc21aiW46R0j9KFFsNj cOZ1tnOh+MNn1MA7DfLUNRKKTvju9UJz+s62yfNEZo00fW0kaEz2wdQNkyzehA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1639881868; a=rsa-sha256; cv=none; b=b30Uf8s05JztNy7QqaqHh6dWKIpucn/GgrMHk3VX+QMERHx6gLSwqD3aV1WW4CgMGlK6rz /hJOtCMv+NPOo06uDAtGan01QQD1DvQaqG2Bf9osrbYrtFXDIEhknVsxF5/A1lVF95sY8E RSoErMlOIXHg6+qSsfltubQScz5y2wC16F+Hl40qwjfpzafM8Gsrzo9t/Y/qkcRVwMFwW8 ia1UDZHBQNMm1CGLjvgmfCQt0sCJ8t/OiRPvHKufLvPG/7IRp4kpsqMurXjPxMSLT0Dq/h 1/IEzVJM+VkofsXfda3frtp74F14ISt3ufTRK0nxpU50ZS/QQltKgAJOIkRCoA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=e0dc92e185b231ceb9c465e35b47e7dad89a3ec8 commit e0dc92e185b231ceb9c465e35b47e7dad89a3ec8 Author: Konstantin Belousov AuthorDate: 2021-12-07 09:29:53 +0000 Commit: Konstantin Belousov CommitDate: 2021-12-19 02:42:51 +0000 elf image activator: convert asserts into errors (cherry picked from commit 9cf78c1cf6e8909e4b5eaedeb86482904c0bbdc4) --- sys/kern/imgact_elf.c | 44 ++++++++++++++++++++++++++------------------ 1 file changed, 26 insertions(+), 18 deletions(-) diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c index af8c2129b3dd..915d21b1ad0c 100644 --- a/sys/kern/imgact_elf.c +++ b/sys/kern/imgact_elf.c @@ -855,28 +855,34 @@ fail: return (error); } -static u_long -__CONCAT(rnd_, __elfN(base))(vm_map_t map __unused, u_long minv, u_long maxv, - u_int align) +static int +__CONCAT(rnd_, __elfN(base))(vm_map_t map, u_long minv, u_long maxv, + u_int align, u_long *resp) { u_long rbase, res; MPASS(vm_map_min(map) <= minv); - MPASS(maxv <= vm_map_max(map)); - MPASS(minv < maxv); - MPASS(minv + align < maxv); + + if (minv >= maxv || minv + align >= maxv || maxv > vm_map_max(map)) { + uprintf("Invalid ELF segments layout\n"); + return (ENOEXEC); + } + arc4rand(&rbase, sizeof(rbase), 0); res = roundup(minv, (u_long)align) + rbase % (maxv - minv); res &= ~((u_long)align - 1); if (res >= maxv) res -= align; + KASSERT(res >= minv, ("res %#lx < minv %#lx, maxv %#lx rbase %#lx", res, minv, maxv, rbase)); KASSERT(res < maxv, ("res %#lx > maxv %#lx, minv %#lx rbase %#lx", res, maxv, minv, rbase)); - return (res); + + *resp = res; + return (0); } static int @@ -1255,13 +1261,13 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *imgp) imgp->proc->p_sysent = sv; maxv = vm_map_max(map) - lim_max(td, RLIMIT_STACK); - if (et_dyn_addr == ET_DYN_ADDR_RAND) { + if (error == 0 && et_dyn_addr == ET_DYN_ADDR_RAND) { KASSERT((map->flags & MAP_ASLR) != 0, ("ET_DYN_ADDR_RAND but !MAP_ASLR")); - et_dyn_addr = __CONCAT(rnd_, __elfN(base))(map, + error = __CONCAT(rnd_, __elfN(base))(map, vm_map_min(map) + mapsz + lim_max(td, RLIMIT_DATA), /* reserve half of the address space to interpreter */ - maxv / 2, 1UL << flsl(maxalign)); + maxv / 2, 1UL << flsl(maxalign), &et_dyn_addr); } vn_lock(imgp->vp, LK_SHARED | LK_RETRY); @@ -1288,10 +1294,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *imgp) RLIMIT_DATA)); if ((map->flags & MAP_ASLR) != 0) { maxv1 = maxv / 2 + addr / 2; - MPASS(maxv1 >= addr); /* No overflow */ - map->anon_loc = __CONCAT(rnd_, __elfN(base))(map, addr, maxv1, + error = __CONCAT(rnd_, __elfN(base))(map, addr, maxv1, (MAXPAGESIZES > 1 && pagesizes[1] != 0) ? - pagesizes[1] : pagesizes[0]); + pagesizes[1] : pagesizes[0], &map->anon_loc); + if (error != 0) + goto ret; } else { map->anon_loc = addr; } @@ -1303,12 +1310,13 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *imgp) if ((map->flags & MAP_ASLR) != 0) { /* Assume that interpreter fits into 1/4 of AS */ maxv1 = maxv / 2 + addr / 2; - MPASS(maxv1 >= addr); /* No overflow */ - addr = __CONCAT(rnd_, __elfN(base))(map, addr, - maxv1, PAGE_SIZE); + error = __CONCAT(rnd_, __elfN(base))(map, addr, + maxv1, PAGE_SIZE, &addr); + } + if (error == 0) { + error = __elfN(load_interp)(imgp, brand_info, interp, + &addr, &imgp->entry_addr); } - error = __elfN(load_interp)(imgp, brand_info, interp, &addr, - &imgp->entry_addr); vn_lock(imgp->vp, LK_SHARED | LK_RETRY); if (error != 0) goto ret;