Commit 341c87bf authored by KAMEZAWA Hiroyuki's avatar KAMEZAWA Hiroyuki Committed by Linus Torvalds
Browse files

elf: limit max map count to safe value 



With ELF, at generating coredump, some more headers other than used
vmas are added.

When max_map_count == 65536, a core generated by following kinds of
code can be unreadable because the number of ELF's program header is
written in 16bit in Ehdr (please see elf.h) and the number overflows.

==
	... = mmap(); (munmap, mprotect, etc...)
	if (failed)
		abort();
==

This can happen in mmap/munmap/mprotect/etc...which calls split_vma().

I think 65536 is not safe as _default_ and reduce it to 65530 is good
for avoiding unexpected corrupted core.

Anyway, max_map_count can be enlarged by sysctl if a user is brave..

Signed-off-by: default avatarKAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Cc: Jakub Jelinek <jakub@redhat.com>
Acked-by: default avatarRoland McGrath <roland@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent b1cfebc9

fs/binfmt_elf.c

+4 −1
Original line number Diff line number Diff line
@@ -1929,7 +1929,10 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un 
	elf = kmalloc(sizeof(*elf), GFP_KERNEL);

	if (!elf)

		goto out;

	

	/*

	 * The number of segs are recored into ELF header as 16bit value.

	 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.

	 */

	segs = current->mm->map_count;

#ifdef ELF_CORE_EXTRA_PHDRS

	segs += ELF_CORE_EXTRA_PHDRS;

include/linux/sched.h

+14 −2
Original line number Diff line number Diff line
@@ -349,8 +349,20 @@ extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner); 
struct nsproxy;

struct user_namespace;



/* Maximum number of active map areas.. This is a random (large) number */

#define DEFAULT_MAX_MAP_COUNT	65536

/*

 * Default maximum number of active map areas, this limits the number of vmas

 * per mm struct. Users can overwrite this number by sysctl but there is a

 * problem.

 *

 * When a program's coredump is generated as ELF format, a section is created

 * per a vma. In ELF, the number of sections is represented in unsigned short.

 * This means the number of sections should be smaller than 65535 at coredump.

 * Because the kernel adds some informative sections to a image of program at

 * generating coredump, we need some margin. The number of extra sections is

 * 1-3 now and depends on arch. We use "5" as safe margin, here.

 */

#define MAPCOUNT_ELF_CORE_MARGIN	(5)

#define DEFAULT_MAX_MAP_COUNT	(USHORT_MAX - MAPCOUNT_ELF_CORE_MARGIN)



extern int sysctl_max_map_count;

CRA Git | Maintained and supported by SUSTech CRA and CCSE