powerpc: Fix random memory corruption in merged elf.h (30415f6a) · Commits · 戴 / test

The merged verison of ELF_CORE_COPY_REGS is basically the PPC64 version, with a memset that came from PPC and a few types abstracted out into #defines. But it's not _quite_ right. The first problem is we calculate the number of registers with: nregs = sizeof(struct pt_regs) / sizeof(ELF_GREG_TYPE) For a 32-bit process on a 64-bit kernel that's bogus because the registers are 64 bits, but ELF_GREG_TYPE is u32, so nregs == 88 which is wrong. The other problem is the memset, which assumes a struct pt_regs is smaller than a struct elf_regs. For a 32-bit process on a 64-bit kernel that's false. The fix is to calculate the number of regs using sizeof(unsigned long), which should always be right, and just memset the whole damn thing _before_ copying the registers in. Signed-off-by:

Michael Ellerman <michael@ellerman.id.au>

include/asm-powerpc/elf.h

+13 −9

Original line number	Diff line number	Diff line
		@@ -178,18 +178,22 @@ typedef elf_vrreg_t elf_vrregset_t32[ELF_NVRREG32];
		static inline void ppc_elf_core_copy_regs(elf_gregset_t elf_regs,
		struct pt_regs *regs)
		{
		int i;
		int gprs = sizeof(struct pt_regs)/sizeof(ELF_GREG_TYPE);
		int i, nregs;

		if (gprs > ELF_NGREG)
		gprs = ELF_NGREG;
		memset((void *)elf_regs, 0, sizeof(elf_gregset_t));

		for (i=0; i < gprs; i++)
		elf_regs[i] = (elf_greg_t)((ELF_GREG_TYPE *)regs)[i];

		memset((char *)(elf_regs) + sizeof(struct pt_regs), 0, \
		sizeof(elf_gregset_t) - sizeof(struct pt_regs));
		/* Our registers are always unsigned longs, whether we're a 32 bit
		* process or 64 bit, on either a 64 bit or 32 bit kernel.
		* Don't use ELF_GREG_TYPE here. */
		nregs = sizeof(struct pt_regs) / sizeof(unsigned long);
		if (nregs > ELF_NGREG)
		nregs = ELF_NGREG;

		for (i = 0; i < nregs; i++) {
		/* This will correctly truncate 64 bit registers to 32 bits
		* for a 32 bit process on a 64 bit kernel. */
		elf_regs[i] = (elf_greg_t)((ELF_GREG_TYPE *)regs)[i];
		}
		}
		#define ELF_CORE_COPY_REGS(gregs, regs) ppc_elf_core_copy_regs(gregs, regs);

Admin message