• Maciej W. Rozycki's avatar
    binfmt_elf: Don't clobber passed executable's file header · 7f5cb247
    Maciej W. Rozycki authored
    commit b582ef5c upstream.
    
    Do not clobber the buffer space passed from `search_binary_handler' and
    originally preloaded by `prepare_binprm' with the executable's file
    header by overwriting it with its interpreter's file header.  Instead
    keep the buffer space intact and directly use the data structure locally
    allocated for the interpreter's file header, fixing a bug introduced in
    2.1.14 with loadable module support (linux-mips.org commit beb11695
    [Import of Linux/MIPS 2.1.14], predating kernel.org repo's history).
    Adjust the amount of data read from the interpreter's file accordingly.
    
    This was not an issue before loadable module support, because back then
    `load_elf_binary' was executed only once for a given ELF executable,
    whether the function succeeded or failed.
    
    With loadable module support supported and enabled, upon a failure of
    `load_elf_binary' -- which may for example be caused by architecture
    code rejecting an executable due to a missing hardware feature requested
    in the file header -- a module load is attempted and then the function
    reexecuted by `search_binary_handler'.  With the executable's file
    header replaced with its interpreter's file header the executable can
    then be erroneously accepted in this subsequent attempt.
    Signed-off-by: default avatarMaciej W. Rozycki <macro@imgtec.com>
    Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
    (cherry picked from commit beebd9fa)
    Signed-off-by: default avatarWilly Tarreau <w@1wt.eu>
    7f5cb247
binfmt_elf.c 52.9 KB