ARM FDPIC_FUNCPTRS personality flag handling looks broken
Jann Horn
jannh at google.com
Thu Mar 25 19:23:52 GMT 2021
Hi!
Tavis noticed that on ARM kernels with CONFIG_BINFMT_ELF_FDPIC, it
looks like the FDPIC_FUNCPTRS personality flag is not reset on
execve(). This would mean that if a process first executes an ELF
FDPIC binary (which forces the personality to PER_LINUX_FDPIC), and
then executes a non-FDPIC binary, the signal handling code
(setup_return()) will have bogus behavior (interpreting a normal
function pointer as an FDPIC function handle).
I think FDPIC_FUNCPTRS should probably either be reset on every
execve() or not be a personality flag at all (since AFAIU pretty much
the whole point of personality flags is that they control behavior
even across execve()).
(I don't have an FDPIC toolchain, so I'm writing this solely based on
having read the code, without having actually tested it.)
More information about the linux-arm-kernel
mailing list