Fix stack overflow with huge PT_NOTE segment [BZ #20419]

A PT_NOTE in a binary could be arbitratily large, so using alloca
for it may cause stack overflow.  If the note is larger than
__MAX_ALLOCA_CUTOFF, use dynamically allocated memory to read it in.

2018-05-05  Paul Pluzhnikov  <ppluzhnikov@google.com>

	[BZ #20419]
	* elf/dl-load.c (open_verify): Fix stack overflow.
	* elf/Makefile (tst-big-note): New test.
	* elf/tst-big-note-lib.S: New.
	* elf/tst-big-note.c: New.

(cherry picked from commit 0065aaaaae51cd60210ec3a7e13dddd8e01ffe2c)

diff --git a/ChangeLog b/ChangeLog
index ca6b3ea30ece8ddc1ec677f47674ec86e45ba8a1..14063a197c42a90d9461c1ae017763fdf124fbab 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2018-05-05  Paul Pluzhnikov  <ppluzhnikov@google.com>
+
+       [BZ #20419]
+       * elf/dl-load.c (open_verify): Fix stack overflow.
+       * elf/Makefile (tst-big-note): New test.
+       * elf/tst-big-note-lib.S: New.
+       * elf/tst-big-note.c: New.
+
 2018-05-04  Stefan Liebler  <stli@linux.vnet.ibm.com>
 
        [BZ #23137]

diff --git a/elf/Makefile b/elf/Makefile
index 8f16690c25bfad3c12cd7b161328ae1c869e3de0..7ce09250721c58edd6981da0b098e4af9b6176eb 100644 (file)
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -191,7 +191,7 @@ tests += restest1 preloadtest loadfail multiload origtest resolvfail \
         tst-tlsalign tst-tlsalign-extern tst-nodelete-opened \
         tst-nodelete2 tst-audit11 tst-audit12 tst-dlsym-error tst-noload \
         tst-latepthread tst-tls-manydynamic tst-nodelete-dlclose \
-        tst-debug1 tst-main1
+        tst-debug1 tst-main1 tst-big-note
 #       reldep9
 tests-internal += loadtest unload unload2 circleload1 \
         neededtest neededtest2 neededtest3 neededtest4 \
@@ -279,7 +279,9 @@ modules-names = testobj1 testobj2 testobj3 testobj4 testobj5 testobj6 \
                tst-latepthreadmod $(tst-tls-many-dynamic-modules) \
                tst-nodelete-dlclose-dso tst-nodelete-dlclose-plugin \
                tst-dlopen-offset-mod1 tst-dlopen-offset-mod2 tst-dlopen-offset-mod3 \
-               tst-main1mod tst-libc_dlvsym-dso
+               tst-main1mod tst-libc_dlvsym-dso \
+               tst-big-note-lib
+
 ifeq (yes,$(have-mtls-dialect-gnu2))
 tests += tst-gnu2-tls1
 modules-names += tst-gnu2-tls1mod
@@ -1460,9 +1462,12 @@ tst-libc_dlvsym-static-ENV = \
   LD_LIBRARY_PATH=$(objpfx):$(common-objpfx):$(common-objpfx)dlfcn
 $(objpfx)tst-libc_dlvsym-static.out: $(objpfx)tst-libc_dlvsym-dso.so
 
+
 $(objpfx)tst-dlopen-offset: $(libdl)
 $(objpfx)tst-dlopen-offset.out: $(objpfx)tst-dlopen-offset-comb.so
 $(objpfx)tst-dlopen-offset-comb.so: $(objpfx)tst-dlopen-offset-mod1.so $(objpfx)tst-dlopen-offset-mod2.so $(objpfx)tst-dlopen-offset-mod3.so
        dd if=$(objpfx)tst-dlopen-offset-mod1.so of=$(objpfx)tst-dlopen-offset-comb.so bs=1024 seek=64
        dd if=$(objpfx)tst-dlopen-offset-mod2.so of=$(objpfx)tst-dlopen-offset-comb.so bs=1024 seek=128
        dd if=$(objpfx)tst-dlopen-offset-mod3.so of=$(objpfx)tst-dlopen-offset-comb.so bs=1024 seek=192
+
+$(objpfx)tst-big-note: $(objpfx)tst-big-note-lib.so

diff --git a/elf/dl-load.c b/elf/dl-load.c
index a79f2f1460f9579e70fea14c0088c1e3e135dd8c..1b08f294e893c243345e93093dbf748eedc06884 100644 (file)
--- a/elf/dl-load.c
+++ b/elf/dl-load.c
@@ -1511,6 +1511,7 @@ open_verify (const char *name, int fd, off_t offset,
       ElfW(Ehdr) *ehdr;
       ElfW(Phdr) *phdr, *ph;
       ElfW(Word) *abi_note;
+      ElfW(Word) *abi_note_malloced = NULL;
       unsigned int osversion;
       size_t maplength;
 
@@ -1685,10 +1686,25 @@ open_verify (const char *name, int fd, off_t offset,
              abi_note = (void *) (fbp->buf + ph->p_offset);
            else
              {
-               abi_note = alloca (size);
+               /* Note: __libc_use_alloca is not usable here, because
+                  thread info may not have been set up yet.  */
+               if (size < __MAX_ALLOCA_CUTOFF)
+                 abi_note = alloca (size);
+               else
+                 {
+                   /* There could be multiple PT_NOTEs.  */
+                   abi_note_malloced = realloc (abi_note_malloced, size);
+                   if (abi_note_malloced == NULL)
+                     goto read_error;
+
+                   abi_note = abi_note_malloced;
+                 }
                __lseek (fd, ph->p_offset, SEEK_SET);
                if (__libc_read (fd, (void *) abi_note, size) != size)
-                 goto read_error;
+                 {
+                   free (abi_note_malloced);
+                   goto read_error;
+                 }
              }
 
            while (memcmp (abi_note, &expected_note, sizeof (expected_note)))
@@ -1723,6 +1739,7 @@ open_verify (const char *name, int fd, off_t offset,
 
            break;
          }
+      free (abi_note_malloced);
     }
 
   return fd;

diff --git a/elf/tst-big-note-lib.S b/elf/tst-big-note-lib.S
new file mode 100644 (file)
index 0000000..6b514a0
--- /dev/null
+++ b/elf/tst-big-note-lib.S
@@ -0,0 +1,26 @@
+/* Bug 20419: test for stack overflow in elf/dl-load.c open_verify()
+   Copyright (C) 2018 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+/* This creates a .so with 8MiB PT_NOTE segment.
+   On a typical Linux system with 8MiB "ulimit -s", that was enough
+   to trigger stack overflow in open_verify.  */
+
+.pushsection .note.big,"a"
+.balign 4
+.fill 8*1024*1024, 1, 0
+.popsection

diff --git a/elf/tst-big-note.c b/elf/tst-big-note.c
new file mode 100644 (file)
index 0000000..fcd2b0e
--- /dev/null
+++ b/elf/tst-big-note.c
@@ -0,0 +1,26 @@
+/* Bug 20419: test for stack overflow in elf/dl-load.c open_verify()
+   Copyright (C) 2018 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+/* This file must be run from within a directory called "elf".  */
+
+int main (int argc, char *argv[])
+{
+  /* Nothing to do here: merely linking against tst-big-note-lib.so triggers
+     the bug.  */
+  return 0;
+}