mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
elf core dump: fix get_user use
The elf_core_dump() code does its work with set_fs(KERNEL_DS) in force, so vma_dump_size() needs to switch back with set_fs(USER_DS) to safely use get_user() for a normal user-space address. Checking for VM_READ optimizes out the case where get_user() would fail anyway. The vm_file check here was already superfluous given the control flow earlier in the function, so that is a cleanup/optimization unrelated to other changes but an obvious and trivial one. Reported-by: Gerald Schaefer <gerald.schaefer@de.ibm.com> Signed-off-by: Roland McGrath <roland@redhat.com>
This commit is contained in:
parent
6cec50838e
commit
92dc07b1f9
|
@ -1208,9 +1208,11 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
|
|||
* check for an ELF header. If we find one, dump the first page to
|
||||
* aid in determining what was mapped here.
|
||||
*/
|
||||
if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {
|
||||
if (FILTER(ELF_HEADERS) &&
|
||||
vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
|
||||
u32 __user *header = (u32 __user *) vma->vm_start;
|
||||
u32 word;
|
||||
mm_segment_t fs = get_fs();
|
||||
/*
|
||||
* Doing it this way gets the constant folded by GCC.
|
||||
*/
|
||||
|
@ -1223,7 +1225,15 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
|
|||
magic.elfmag[EI_MAG1] = ELFMAG1;
|
||||
magic.elfmag[EI_MAG2] = ELFMAG2;
|
||||
magic.elfmag[EI_MAG3] = ELFMAG3;
|
||||
if (get_user(word, header) == 0 && word == magic.cmp)
|
||||
/*
|
||||
* Switch to the user "segment" for get_user(),
|
||||
* then put back what elf_core_dump() had in place.
|
||||
*/
|
||||
set_fs(USER_DS);
|
||||
if (unlikely(get_user(word, header)))
|
||||
word = 0;
|
||||
set_fs(fs);
|
||||
if (word == magic.cmp)
|
||||
return PAGE_SIZE;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue