Re: [PATCH] binfmt_elf: Move brk out of mmap when doing direct loader exec

[Guenter Roeck]

On Mon, Apr 15, 2019 at 09:23:20PM -0700, Kees Cook wrote:
> Commit eab09532d400 ("binfmt_elf: use ELF_ET_DYN_BASE only for PIE"),
> made changes in the rare case when the ELF loader was directly invoked
> (e.g to set a non-inheritable LD_LIBRARY_PATH, testing new versions of
> the loader), by moving into the mmap region to avoid both ET_EXEC and PIE
> binaries. This had the effect of also moving the brk region into mmap,
> which could lead to the stack and brk being arbitrarily close to each
> other. An unlucky process wouldn't get its requested stack size and stack
> allocations could end up scribbling on the heap.
> 

This patch results in crashes of my xtensa boot tests.

Run /sbin/init as init process
Kernel panic - not syncing: Attempted to kill init!  exitcode=0x0000000b

Bisect log is attached. The crash is seen in next-20190417 and next-20190418.

Guenter

---
# bad: [3f018f4a019a1110527910bac52161e57107957c] Add linux-next specific files for 20190418
# good: [15ade5d2e7775667cf191cf2f94327a4889f8b9d] Linux 5.1-rc4
git bisect start 'HEAD' 'v5.1-rc4'
# good: [d49e1f8649c84f154e7df59300264f59b736f329] Merge remote-tracking branch 'crypto/master'
git bisect good d49e1f8649c84f154e7df59300264f59b736f329
# good: [06a21957e5c0aae87fb94b97ef965818bd7c9dac] Merge remote-tracking branch 'spi/for-next'
git bisect good 06a21957e5c0aae87fb94b97ef965818bd7c9dac
# good: [c44f3caed068c67fe01056329e7e6cbf8f4920a8] Merge remote-tracking branch 'staging/staging-next'
git bisect good c44f3caed068c67fe01056329e7e6cbf8f4920a8
# good: [ca75e0d0aafd76ceb1f5a8f8544d22f841b7e296] Merge remote-tracking branch 'coresight/next'
git bisect good ca75e0d0aafd76ceb1f5a8f8544d22f841b7e296
# bad: [711a07489617c04954816b16d0d500b1e81398c1] cpumask-fix-double-string-traverse-in-cpumask_parse-fix
git bisect bad 711a07489617c04954816b16d0d500b1e81398c1
# good: [47d765617fc96a61b317dd916a48f28bec14b32c] mm/hmm: mirror hugetlbfs (snapshoting, faulting and DMA mapping)
git bisect good 47d765617fc96a61b317dd916a48f28bec14b32c
# good: [99b8edbb7d2564aa751481aae99a5715170b80ea] mm, memcg: make scan aggression always exclude protection
git bisect good 99b8edbb7d2564aa751481aae99a5715170b80ea
# good: [9174b7e52219aebd841086d67988295096bab871] lib/sort: avoid indirect calls to built-in swap
git bisect good 9174b7e52219aebd841086d67988295096bab871
# good: [b7a32277de780ace15114ce9f89c32f5b28276a0] fs/binfmt_elf.c: remove unneeded initialization of mm->start_stack
git bisect good b7a32277de780ace15114ce9f89c32f5b28276a0
# bad: [9100e2f3a64a66c366cd1f4b8f46d3e2d916ec54] fix "fs/binfmt_elf.c: move brk out of mmap when doing direct loader exec"
git bisect bad 9100e2f3a64a66c366cd1f4b8f46d3e2d916ec54
# good: [c1dcda60c739c3a4b3226317fca17dcd2827f604] fs/binfmt_elf.c: delete trailing "return;" in functions returning "void"
git bisect good c1dcda60c739c3a4b3226317fca17dcd2827f604
# good: [f39fe61cc3b48fe58ea1470ad7d6512cb45c76d3] fs//binfmt_elf.c: move variables initialization closer to their usage
git bisect good f39fe61cc3b48fe58ea1470ad7d6512cb45c76d3
# bad: [cb084e1ba0b0c3353e1fadf52f647ff85eb8989c] fs/binfmt_elf.c: move brk out of mmap when doing direct loader exec
git bisect bad cb084e1ba0b0c3353e1fadf52f647ff85eb8989c
# first bad commit: [cb084e1ba0b0c3353e1fadf52f647ff85eb8989c] fs/binfmt_elf.c: move brk out of mmap when doing direct loader exec