binfmt_elf: remove the 4k limitation of program header size

We have assembly code generated by a script. GCC successfully compiles
it. However, the kernel cannot load it on an ARM64 platform with a 4K
page size. In contrast, the same ELF file loads correctly on the same
platform with a 64K page size.

The root cause is the Linux kernel's ELF_MIN_ALIGN limitation on the
program headers of ELF files. The ELF file contains 78 program headers
(the script inserts many holes when generating the assembly code). On
ARM64 with a 4K page size, the ELF_MIN_ALLIGN enforces a maximum of 74
program headers, causing the ELF file to fail. However, with a 64K page
size, the ELF_MIN_ALIGN is relaxed to over 1,184 program headers, allowing
the file to run correctly.

Cook kindly identified[1] that this limitation was introduced in
Linux-0.99.15f without an explanation for its purpose.

The ELF specification does not impose such a restriction on program
headers. Removing the ELF_MIN_ALIGN limitation on program headers to
align with the ELF spec. After removing ELF_MIN_ALIGN limitation,
64K size limitation still exist which should be sufficient.

Suggested-by: Kees Cook <kees@kernel.org>
Link: https://lore.kernel.org/linux-mm/202506270854.A729825@keescook/
Signed-off-by: Yin Fengwei <fengwei_yin@linux.alibaba.com>
Link: https://lore.kernel.org/r/20250717110108.55586-1-fengwei_yin@linux.alibaba.com
Signed-off-by: Kees Cook <kees@kernel.org>

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 92cf005468b58646d334a9e2ac840b24a10607fe..caeddccaa1fe9b4e07b3955eb97256c3e2e66c05 100644 (file)
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -519,7 +519,7 @@ static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex,
        /* Sanity check the number of program headers... */
        /* ...and their total size. */
        size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
-       if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN)
+       if (size == 0 || size > 65536)
                goto out;
 
        elf_phdata = kmalloc(size, GFP_KERNEL);