git: aa182e53e8ed - stable/12 - Disallow invalid PT_GNU_STACK

The branch stable/12 has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=aa182e53e8ed760407a140bf906d5e623dbcea98

commit aa182e53e8ed760407a140bf906d5e623dbcea98
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2022-03-18 17:56:32 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2022-09-04 23:57:00 +0000

    Disallow invalid PT_GNU_STACK
    
    Stack must be at least readable and writable.
    
    PR:             242570
    Reviewed by:    kib, markj
    MFC after:      1 month
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D35867
    
    (cherry picked from commit fbafa98a94cc7f4f30d71003c230d1b5d4c5960b)
---
 sys/kern/imgact_elf.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c
index dba87d2853ca..9f5cd77f097f 100644
--- a/sys/kern/imgact_elf.c
+++ b/sys/kern/imgact_elf.c
@@ -1141,9 +1141,16 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *imgp)
 				goto ret;
 			break;
 		case PT_GNU_STACK:
-			if (__elfN(nxstack))
+			if (__elfN(nxstack)) {
 				imgp->stack_prot =
 				    __elfN(trans_prot)(phdr[i].p_flags);
+				if ((imgp->stack_prot & VM_PROT_RW) !=
+				    VM_PROT_RW) {
+					uprintf("Invalid PT_GNU_STACK\n");
+					error = ENOEXEC;
+					goto ret;
+				}
+			}
 			imgp->stack_sz = phdr[i].p_memsz;
 			break;
 		case PT_PHDR: 	/* Program header table info */