From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id 5F9E9384AB42 for ; Thu, 2 May 2024 16:57:26 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 5F9E9384AB42 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 5F9E9384AB42 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1714669049; cv=none; b=lFf8rj8Xodhv7IQtOBvCcjarBfJRWe181CzLrJjABfHDLYGQ7ltQKxAgl3OW6W00U/1M+BrEU7fhFuPNirF64YoRe/wgHmN/pTCGrEg06bwdvFeUt/3Vj38iyf1yclfi2I9qHYqJjTl6jSWxp4Cdxg3Ova4L18JqHQk58ONhAKk= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1714669049; c=relaxed/simple; bh=MNdW6lK8gzIJJqBFP75JkXus5Vtsu18l0ExsCGG33pQ=; h=DKIM-Signature:MIME-Version:From:Date:Message-ID:Subject:To; b=Zgi17EhqZcXV3f3hKqgVmSUoq+96l7yG1q8rxbj8jiSL74wEvVEfvatMebVhK5wTc7dr3xHAV1MgHcjbsK5erygWgXgqnYbxGMD4U+bsIfuO3NDac/bcgy9uRe0zvjDtY2mTVRIhq9ZkT4snZDxyJ1F78mWqR8PcffyTWpTXSTU= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1714669046; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xjOs8a3oiZNWT1ri1OLldcGTMPPsIlFI+ScIfG04zJ8=; b=f1wD6ZEUK163gQY+kL9UkaTk07kh2nvL5rT1BUznF3tplEw3GF5Bu4Nr5nGo0VuwNxabnU UNvpU7uCvOuMlU3i2TCcvTb/LRERah/KjUlrSt5J3tApAinsxDh9R9w7qv+Yzeu4oBaqJG UZYaJxaINr0R2wflgv+wqxzgk+uhgwE= Received: from mail-ej1-f72.google.com (mail-ej1-f72.google.com [209.85.218.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-170-NP4kf8aSP_yQMD7egBIaiQ-1; Thu, 02 May 2024 12:57:24 -0400 X-MC-Unique: NP4kf8aSP_yQMD7egBIaiQ-1 Received: by mail-ej1-f72.google.com with SMTP id a640c23a62f3a-a58bca80981so442800766b.0 for ; Thu, 02 May 2024 09:57:24 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714669043; x=1715273843; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=xjOs8a3oiZNWT1ri1OLldcGTMPPsIlFI+ScIfG04zJ8=; b=axgQJSqA1aN9ovFXSkRxllx71pbSz611xhMrs44SIhqbqSoaerouCJPNMDvUfvKHg/ 1d9HNpZl89Ql/99WrOqZncpY4WElcx2dWgv1gLyIVm5kUjXV/wmC0V4zF40Pe9pSHJlY DTVhQaywDNahBXqDsSpMRuCce5YFHiHsCe9pEpVe8teO8kcfER+xNIDT/KD1vKW+RiWg hFJn7xuR19wvfugz/A2Za2BMWI5oXyXdzz3MctAVgxAaNb2C32tgjZXL5HzXEDjXYjCU qXrsWubdSp0tWZcWUdvrU9ePEMQ8/pkvgiPFo5uRtKeRjKVArTjZy4TR8FafozQQCuZm zMGw== X-Gm-Message-State: AOJu0YxbVkFqV+iIGycruGuDiek/hQodcwBoifATY1gTgwHR63B2Miyg 0leBFkXtSox72P2kOILYwwSeTiJ9irKXJp8gdO72qL95noDNvOj2ZT8Ea3JpLAYftzh2/hYXu0/ YRE5ikK11LQimQUu48v5rFXVhi2Hjg+iHrPhmv4Jg0vWL6PQ5dceF1Ih/evtMTeKMf9v8K1scYD cGOZnZNQN4UVEU05emPZyiTDk2AtFXWhKX X-Received: by 2002:a17:906:b7da:b0:a58:e4dc:ad99 with SMTP id fy26-20020a170906b7da00b00a58e4dcad99mr59098ejb.2.1714669043462; Thu, 02 May 2024 09:57:23 -0700 (PDT) X-Google-Smtp-Source: AGHT+IF+5N2qcbA+7IEPrMYtJxkoEx5LFdXMnd1m1IoDCp3tFCQ92Zms8PH/p+UG2v02YTASmPBfFod+4O7YaSHSKb8= X-Received: by 2002:a17:906:b7da:b0:a58:e4dc:ad99 with SMTP id fy26-20020a170906b7da00b00a58e4dcad99mr59085ejb.2.1714669042952; Thu, 02 May 2024 09:57:22 -0700 (PDT) MIME-Version: 1.0 References: <20240502163716.1107975-1-adhemerval.zanella@linaro.org> <20240502163716.1107975-2-adhemerval.zanella@linaro.org> In-Reply-To: <20240502163716.1107975-2-adhemerval.zanella@linaro.org> From: Joe Simmons-Talbott Date: Thu, 2 May 2024 12:57:06 -0400 Message-ID: Subject: Re: [PATCH v2 1/4] elf: Only process multiple tunable once (BZ 31686) To: Adhemerval Zanella Cc: libc-alpha@sourceware.org, Siddhesh Poyarekar , Yuto Maeda , Yutaro Shimizu X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Spam-Status: No, score=-12.8 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,KAM_SHORT,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On Thu, May 2, 2024 at 12:37=E2=80=AFPM Adhemerval Zanella wrote: > > The 680c597e9c3 commit made loader reject ill-formatted strings by > first tracking all set tunables and then applying them. However, it does > not take into consideration if the same tunable is set multiple times, > where parse_tunables_string appends the found tunable without checking > if it was already in the list. It leads to a stack-based buffer overflow > if the tunable is specified more than the total number of tunables. For > instance: > > GLIBC_TUNABLES=3Dglibc.malloc.check=3D2:... (repeat over the number of > total support for different tunable). > > Instead, use the index of the tunable list to get the expected tunable > entry. Since now the initial list is zero-initialized, the compiler > might emit an extra memset and this requires some minor adjustment > on some ports. > > Checked on x86_64-linux-gnu and aarch64-linux-gnu. > > Reported-by: Yuto Maeda > Reported-by: Yutaro Shimizu > --- > elf/dl-tunables.c | 30 ++++++----- > elf/tst-tunables.c | 58 +++++++++++++++++++++- > sysdeps/aarch64/multiarch/memset_generic.S | 4 ++ > sysdeps/sparc/sparc64/rtld-memset.c | 3 ++ > 4 files changed, 81 insertions(+), 14 deletions(-) > > diff --git a/elf/dl-tunables.c b/elf/dl-tunables.c > index d3ccd2ecd4..1db80e0f92 100644 > --- a/elf/dl-tunables.c > +++ b/elf/dl-tunables.c > @@ -32,6 +32,7 @@ > #include > #include > #include > +#include > > #define TUNABLES_INTERNAL 1 > #include "dl-tunables.h" > @@ -221,8 +222,7 @@ parse_tunables_string (const char *valstring, struct = tunable_toset_t *tunables) > > if (tunable_is_name (cur->name, name)) > { > - tunables[ntunables++] =3D > - (struct tunable_toset_t) { cur, value, p - value }; > + tunables[i] =3D (struct tunable_toset_t) { cur, value, p - = value }; > > /* Ignore tunables if enable_secure is set */ > if (tunable_is_name ("glibc.rtld.enable_secure", name)) > @@ -245,23 +245,27 @@ parse_tunables_string (const char *valstring, struc= t tunable_toset_t *tunables) > static void > parse_tunables (const char *valstring) > { > - struct tunable_toset_t tunables[tunables_list_size]; > - int ntunables =3D parse_tunables_string (valstring, tunables); > - if (ntunables =3D=3D -1) > + struct tunable_toset_t tunables[tunables_list_size] =3D { 0 }; > + if (parse_tunables_string (valstring, tunables) =3D=3D -1) > { > _dl_error_printf ( > "WARNING: ld.so: invalid GLIBC_TUNABLES `%s': ignored.\n", valst= ring); > return; > } > > - for (int i =3D 0; i < ntunables; i++) > - if (!tunable_initialize (tunables[i].t, tunables[i].value, > - tunables[i].len)) > - _dl_error_printf ("WARNING: ld.so: invalid GLIBC_TUNABLES value `%= .*s' " > - "for option `%s': ignored.\n", > - (int) tunables[i].len, > - tunables[i].value, > - tunables[i].t->name); > + for (int i =3D 0; i < tunables_list_size; i++) > + { > + if (tunables[i].t =3D=3D NULL) > + continue; > + > + if (!tunable_initialize (tunables[i].t, tunables[i].value, > + tunables[i].len)) > + _dl_error_printf ("WARNING: ld.so: invalid GLIBC_TUNABLES value `= %.*s' " > + "for option `%s': ignored.\n", > + (int) tunables[i].len, > + tunables[i].value, > + tunables[i].t->name); > + } > } > > /* Initialize the tunables list from the environment. For now we only u= se the > diff --git a/elf/tst-tunables.c b/elf/tst-tunables.c > index 095b5c81d9..8f4ee46ad5 100644 > --- a/elf/tst-tunables.c > +++ b/elf/tst-tunables.c > @@ -17,6 +17,7 @@ > . */ > > #include > +#define TUNABLES_INTERNAL 1 > #include > #include > #include > @@ -24,12 +25,13 @@ > #include > #include > #include > +#include > > static int restart; > #define CMDLINE_OPTIONS \ > { "restart", no_argument, &restart, 1 }, > > -static const struct test_t > +static struct test_t > { > const char *name; > const char *value; > @@ -284,6 +286,29 @@ static const struct test_t > 0, > 0, > }, > + /* Also check for repeated tunables with a count larger than the total= number > + of tunables. */ > + { > + "GLIBC_TUNABLES", > + NULL, > + 2, > + 0, > + 0, > + }, > + { > + "GLIBC_TUNABLES", > + NULL, > + 1, > + 0, > + 0, > + }, > + { > + "GLIBC_TUNABLES", > + NULL, > + 0, > + 0, > + 0, > + }, > }; > > static int > @@ -327,6 +352,37 @@ do_test (int argc, char *argv[]) > spargv[i] =3D NULL; > } > > + /* Create a tunable line with the duplicate values with a total number > + larger than the different number of tunables. */ > + { > + enum { tunables_list_size =3D array_length (tunable_list) }; > + const char *value =3D ""; > + for (int i =3D 0; i < tunables_list_size; i++) > + value =3D xasprintf ("%sglibc.malloc.check=3D2%c", > + value, > + i =3D=3D (tunables_list_size - 1) ? '\0' : ':'); > + tests[33].value =3D value; > + } > + /* Same as before, but the last tunable vallues is differen than the value is different > + rest. */ > + { > + enum { tunables_list_size =3D array_length (tunable_list) }; > + const char *value =3D ""; > + for (int i =3D 0; i < tunables_list_size - 1; i++) > + value =3D xasprintf ("%sglibc.malloc.check=3D2:", value); > + value =3D xasprintf ("%sglibc.malloc.check=3D1", value); > + tests[34].value =3D value; > + } > + /* Same as before, but with an invalid last entry. */ > + { > + enum { tunables_list_size =3D array_length (tunable_list) }; > + const char *value =3D ""; > + for (int i =3D 0; i < tunables_list_size - 1; i++) > + value =3D xasprintf ("%sglibc.malloc.check=3D2:", value); > + value =3D xasprintf ("%sglibc.malloc.check=3D1=3D1", value); > + tests[35].value =3D value; > + } > + > for (int i =3D 0; i < array_length (tests); i++) > { > snprintf (nteststr, sizeof nteststr, "%d", i); > diff --git a/sysdeps/aarch64/multiarch/memset_generic.S b/sysdeps/aarch64= /multiarch/memset_generic.S > index 81748bdbce..e125a5ed85 100644 > --- a/sysdeps/aarch64/multiarch/memset_generic.S > +++ b/sysdeps/aarch64/multiarch/memset_generic.S > @@ -33,3 +33,7 @@ > #endif > > #include <../memset.S> > + > +#if IS_IN (rtld) > +strong_alias (memset, __memset_generic) > +#endif > diff --git a/sysdeps/sparc/sparc64/rtld-memset.c b/sysdeps/sparc/sparc64/= rtld-memset.c > index 55f3835790..a19202a620 100644 > --- a/sysdeps/sparc/sparc64/rtld-memset.c > +++ b/sysdeps/sparc/sparc64/rtld-memset.c > @@ -1 +1,4 @@ > #include > +#if IS_IN(rtld) > +strong_alias (memset, __memset_ultra1) > +#endif > -- > 2.43.0 > --=20 Joe Simmons-Talbott