From jason@jsn.kmost.express.ru  Tue Apr 25 10:15:10 2000
Return-Path: <jason@jsn.kmost.express.ru>
Received: from jsn.kmost.express.ru (jsn.kmost.express.ru [212.24.37.101])
	by hub.freebsd.org (Postfix) with ESMTP id 9DCEB37BDB1
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 25 Apr 2000 10:15:08 -0700 (PDT)
	(envelope-from jason@jsn.kmost.express.ru)
Received: (from jason@localhost)
	by jsn.kmost.express.ru (8.9.3/8.9.3) id VAA00672;
	Tue, 25 Apr 2000 21:17:43 +0400 (MSD)
	(envelope-from jason)
Message-Id: <200004251717.VAA00672@jsn.kmost.express.ru>
Date: Tue, 25 Apr 2000 21:17:43 +0400 (MSD)
From: jason@express.ru
Sender: jason@jsn.kmost.express.ru
Reply-To: jason@express.ru
To: FreeBSD-gnats-submit@freebsd.org
Subject: rlimits are never checked in exec() if executable format is ELF
X-Send-Pr-Version: 3.2

>Number:         18209
>Category:       kern
>Synopsis:       rlimits are never checked in exec() if executable format is ELF
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    green
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Apr 25 10:20:01 PDT 2000
>Closed-Date:    Fri Jun 20 20:17:19 PDT 2003
>Last-Modified:  Fri Jun 20 20:17:19 PDT 2003
>Originator:     Dmitry Kim
>Release:        FreeBSD 4.0-RELEASE i386
>Organization:
TSB "Russian Express"
>Environment:

Any version of FreeBSD from 3.0 to CURRENT

>Description:

when handling exec*() system calls, FreeBSD checks if the new executable image
memory requirements fit into active RLIMIT_* bounds. if they do not fit,
exec*() fails returning ENOMEM. The problem is, this check is never done for
ELF binaries, thus, ELF-format program can grab all available memory, no matter
how low *rlimits are. 

>How-To-Repeat:

/*
 *  This program demonstrates a leak in freebsd exec(), which [erroneously]
 *  allows ELF program to get as much memory as it wishes, ignoring *rlimit
 *  settings, while [correctly] denying any non-ELF program to exceed *rlimit
 *  settings on exec().
 *  How to use:
 *        gcc -elf -o m_elf m.c        # compat 3 probably required for fbsd4
 *        gcc -aout -o m_aout m.c
 *        /usr/bin/limits -d 1 ./m_aout
 *        /usr/bin/limits -d 1 ./m_elf
 *  you'll see the difference.
 */

#include <stdio.h>
#include <unistd.h>
#include <string.h>

char            a[ 10000000 ] ;

int             main( int ac, char **av ) {
        memset( a, 1, sizeof(a) ) ;
        puts( "sleeping" ) ;
        sleep( 100 ) ;
        return 0 ;
}

>Fix:

Index: kern/imgact_elf.c
===================================================================
RCS file: /home/cvsroot/jsn/sys/kern/imgact_elf.c,v
retrieving revision 1.1.1.1
retrieving revision 1.4
diff -u -r1.1.1.1 -r1.4
--- kern/imgact_elf.c	2000/04/17 10:30:39	1.1.1.1
+++ kern/imgact_elf.c	2000/04/25 16:52:11	1.4
@@ -451,7 +451,39 @@
 		return ENOEXEC;
 	}
 	phdr = (const Elf_Phdr*)(imgp->image_header + hdr->e_phoff);
+
+	/* we better check rlimits *before* new vmspace is exec()-ed */
+	for (i = 0; i < hdr->e_phnum; i++) {
+		if (phdr[i].p_type == PT_LOAD) {	/* Loadable segment */
+			/*
+			 * Is this .text or .data ??
+			 *
+			 * We only handle one each of those yet XXX
+			 */
+			if (hdr->e_entry >= phdr[i].p_vaddr &&
+			hdr->e_entry <(phdr[i].p_vaddr+phdr[i].p_memsz)) {
+  				text_addr = trunc_page(phdr[i].p_vaddr);
+  				text_size = round_page(phdr[i].p_memsz +
+						       phdr[i].p_vaddr -
+						       text_addr);
+				entry = (u_long)hdr->e_entry;
+			} else {
+  				data_addr = trunc_page(phdr[i].p_vaddr);
+  				data_size = round_page(phdr[i].p_memsz +
+						       phdr[i].p_vaddr -
+						       data_addr);
+			}
+		}
+	}
 	
+
+	if (text_size > MAXTSIZ ||
+	    text_size + data_size >
+		imgp->proc->p_rlimit[RLIMIT_DATA].rlim_cur) {
+		error = ENOMEM ;
+		goto fail ;
+	}
+
 	/*
 	 * From this point on, we may have resources that need to be freed.
 	 */
@@ -481,25 +513,6 @@
   						     phdr[i].p_memsz,
   						     phdr[i].p_filesz, prot)) != 0)
   				goto fail;
-
-			/*
-			 * Is this .text or .data ??
-			 *
-			 * We only handle one each of those yet XXX
-			 */
-			if (hdr->e_entry >= phdr[i].p_vaddr &&
-			hdr->e_entry <(phdr[i].p_vaddr+phdr[i].p_memsz)) {
-  				text_addr = trunc_page(phdr[i].p_vaddr);
-  				text_size = round_page(phdr[i].p_memsz +
-						       phdr[i].p_vaddr -
-						       text_addr);
-				entry = (u_long)hdr->e_entry;
-			} else {
-  				data_addr = trunc_page(phdr[i].p_vaddr);
-  				data_size = round_page(phdr[i].p_memsz +
-						       phdr[i].p_vaddr -
-						       data_addr);
-			}
 			break;
 	  	case PT_INTERP:	/* Path to interpreter */
 			if (phdr[i].p_filesz > MAXPATHLEN ||


>Release-Note:
>Audit-Trail:

From: vova@express.ru
To: freebsd-gnats-submit@FreeBSD.org, jason@express.ru
Cc:  
Subject: Re: kern/18209 rlimits are never checked in exec() if executable
 format is ELF
Date: Mon, 15 May 2000 18:05:02 +0400 (MSD)

 More detailed fix for ELF exec() and fix for mmap() limits problem there:
 http://www.redline.ru/~jason/bsd.html
 
 --
 TSB Russian Express, Moscow
 Vladimir B. Grebenschikov, vova@express.ru
 
 
Responsible-Changed-From-To: freebsd-bugs->green 
Responsible-Changed-By: kris 
Responsible-Changed-When: Fri Sep 22 01:33:15 PDT 2000 
Responsible-Changed-Why:  
I hereby volunteer green to look at this problem 

http://www.freebsd.org/cgi/query-pr.cgi?pr=18209 
State-Changed-From-To: open->feedback 
State-Changed-By: green 
State-Changed-When: Mon Feb 19 13:42:15 PST 2001 
State-Changed-Why:  
This needs modification to actually count all the loadable segments 
and total them, THEN check against the size.  That's about it, though; 
otherwise, this seems almost right so if that's fixed, it should be 
good. 


http://www.freebsd.org/cgi/query-pr.cgi?pr=18209 

From: Andrey Alekseyev <uitm@zenon.net>
To: freebsd-gnats-submit@FreeBSD.org, jason@nichego.net,
	uitm@zenon.net
Cc:  
Subject: Re: kern/18209: rlimits are never checked in exec() if executable format 
 is ELF
Date: Fri, 17 May 2002 22:11:02 +0400

 A collection of these patches updated for RELENG_4 with respect to
 now definable variables like MAXDSIZ could be found here:
 http://www.blackflag.ru/patches/
 
 
 -- 
 Andrey Alekseyev. Zenon N.S.P.
State-Changed-From-To: feedback->closed 
State-Changed-By: jmg 
State-Changed-When: Fri Jun 20 20:16:11 PDT 2003 
State-Changed-Why:  
This functionality has already been added.  If you want the other 
elf loader improvements committed, update the patches, and open a new 
PR. 

Thanks. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=18209 
>Unformatted:
