elf core dump: fix get_user use (92dc07b1) · Commits · 戴 / test

The elf_core_dump() code does its work with set_fs(KERNEL_DS) in force, so vma_dump_size() needs to switch back with set_fs(USER_DS) to safely use get_user() for a normal user-space address. Checking for VM_READ optimizes out the case where get_user() would fail anyway. The vm_file check here was already superfluous given the control flow earlier in the function, so that is a cleanup/optimization unrelated to other changes but an obvious and trivial one. Reported-by:

Gerald Schaefer <gerald.schaefer@de.ibm.com> Signed-off-by:

Roland McGrath <roland@redhat.com>

fs/binfmt_elf.c

+12 −2

Original line number	Diff line number	Diff line
		@@ -1208,9 +1208,11 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
		* check for an ELF header. If we find one, dump the first page to
		* aid in determining what was mapped here.
		*/
		if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {
		if (FILTER(ELF_HEADERS) &&
		vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
		u32 __user header = (u32 __user ) vma->vm_start;
		u32 word;
		mm_segment_t fs = get_fs();
		/*
		* Doing it this way gets the constant folded by GCC.
		*/
		@@ -1223,7 +1225,15 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
		magic.elfmag[EI_MAG1] = ELFMAG1;
		magic.elfmag[EI_MAG2] = ELFMAG2;
		magic.elfmag[EI_MAG3] = ELFMAG3;
		if (get_user(word, header) == 0 && word == magic.cmp)
		/*
		* Switch to the user "segment" for get_user(),
		* then put back what elf_core_dump() had in place.
		*/
		set_fs(USER_DS);
		if (unlikely(get_user(word, header)))
		word = 0;
		set_fs(fs);
		if (word == magic.cmp)
		return PAGE_SIZE;
		}

Admin message