Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2024-12-29 09:13:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

binfmt_elf_fdpic: fix crash on MMU system with dynamic binaries

Browse Source 
In elf_fdpic_map_file() there is a test to ensure the dynamic section in
user space is properly terminated. However it does so by dereferencing
a user address directly. Add proper user space accessor.

Signed-off-by: Nicolas Pitre <nico@linaro.org>
Acked-by: Mickael GUENE <mickael.guene@st.com>
Tested-by: Vincent Abriou <vincent.abriou@st.com>
Tested-by: Andras Szemzo <szemzo.andras@gmail.com>
This commit is contained in:
Nicolas Pitre 2017-08-16 18:56:14 -04:00
parent 4755200b6b
commit cdf38888ed
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fs/binfmt_elf_fdpic.c
View File

@ -835,6 +835,9 @@ static int elf_fdpic_map_file(struct elf_fdpic_params *params,
if (phdr->p_vaddr >= seg->p_vaddr &&
phdr->p_vaddr + phdr->p_memsz <=
seg->p_vaddr + seg->p_memsz) {
Elf32_Dyn __user *dyn;
Elf32_Sword d_tag;
params->dynamic_addr =
(phdr->p_vaddr - seg->p_vaddr) +
seg->addr;
@ -847,8 +850,9 @@ static int elf_fdpic_map_file(struct elf_fdpic_params *params,
goto dynamic_error;
tmp = phdr->p_memsz / sizeof(Elf32_Dyn);
if (((Elf32_Dyn *)
params->dynamic_addr)[tmp - 1].d_tag != 0)
dyn = (Elf32_Dyn __user *)params->dynamic_addr;
__get_user(d_tag, &dyn[tmp - 1].d_tag);
if (d_tag != 0)
goto dynamic_error;
break;
}