Commit 2217b982 authored by Max Filippov's avatar Max Filippov Committed by Greg Ungerer

binfmt_flat: revert "binfmt_flat: don't offset the data start"

binfmt_flat loader uses the gap between text and data to store data
segment pointers for the libraries. Even in the absence of shared
libraries it stores at least one pointer to the executable's own data
segment. Text and data can go back to back in the flat binary image and
without offsetting data segment last few instructions in the text
segment may get corrupted by the data segment pointer.

Fix it by reverting commit a2357223 ("binfmt_flat: don't offset the
data start").

Cc: stable@vger.kernel.org
Fixes: a2357223 ("binfmt_flat: don't offset the data start")
Signed-off-by: default avatarMax Filippov <jcmvbkbc@gmail.com>
Signed-off-by: default avatarGreg Ungerer <gerg@linux-m68k.org>
parent d012a719
...@@ -576,7 +576,7 @@ static int load_flat_file(struct linux_binprm *bprm, ...@@ -576,7 +576,7 @@ static int load_flat_file(struct linux_binprm *bprm,
goto err; goto err;
} }
len = data_len + extra; len = data_len + extra + MAX_SHARED_LIBS * sizeof(unsigned long);
len = PAGE_ALIGN(len); len = PAGE_ALIGN(len);
realdatastart = vm_mmap(NULL, 0, len, realdatastart = vm_mmap(NULL, 0, len,
PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 0); PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 0);
...@@ -590,7 +590,9 @@ static int load_flat_file(struct linux_binprm *bprm, ...@@ -590,7 +590,9 @@ static int load_flat_file(struct linux_binprm *bprm,
vm_munmap(textpos, text_len); vm_munmap(textpos, text_len);
goto err; goto err;
} }
datapos = ALIGN(realdatastart, FLAT_DATA_ALIGN); datapos = ALIGN(realdatastart +
MAX_SHARED_LIBS * sizeof(unsigned long),
FLAT_DATA_ALIGN);
pr_debug("Allocated data+bss+stack (%u bytes): %lx\n", pr_debug("Allocated data+bss+stack (%u bytes): %lx\n",
data_len + bss_len + stack_len, datapos); data_len + bss_len + stack_len, datapos);
...@@ -620,7 +622,7 @@ static int load_flat_file(struct linux_binprm *bprm, ...@@ -620,7 +622,7 @@ static int load_flat_file(struct linux_binprm *bprm,
memp_size = len; memp_size = len;
} else { } else {
len = text_len + data_len + extra; len = text_len + data_len + extra + MAX_SHARED_LIBS * sizeof(u32);
len = PAGE_ALIGN(len); len = PAGE_ALIGN(len);
textpos = vm_mmap(NULL, 0, len, textpos = vm_mmap(NULL, 0, len,
PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE, 0); PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE, 0);
...@@ -635,7 +637,9 @@ static int load_flat_file(struct linux_binprm *bprm, ...@@ -635,7 +637,9 @@ static int load_flat_file(struct linux_binprm *bprm,
} }
realdatastart = textpos + ntohl(hdr->data_start); realdatastart = textpos + ntohl(hdr->data_start);
datapos = ALIGN(realdatastart, FLAT_DATA_ALIGN); datapos = ALIGN(realdatastart +
MAX_SHARED_LIBS * sizeof(u32),
FLAT_DATA_ALIGN);
reloc = (__be32 __user *) reloc = (__be32 __user *)
(datapos + (ntohl(hdr->reloc_start) - text_len)); (datapos + (ntohl(hdr->reloc_start) - text_len));
...@@ -652,9 +656,8 @@ static int load_flat_file(struct linux_binprm *bprm, ...@@ -652,9 +656,8 @@ static int load_flat_file(struct linux_binprm *bprm,
(text_len + full_data (text_len + full_data
- sizeof(struct flat_hdr)), - sizeof(struct flat_hdr)),
0); 0);
if (datapos != realdatastart) memmove((void *) datapos, (void *) realdatastart,
memmove((void *)datapos, (void *)realdatastart, full_data);
full_data);
#else #else
/* /*
* This is used on MMU systems mainly for testing. * This is used on MMU systems mainly for testing.
...@@ -710,7 +713,8 @@ static int load_flat_file(struct linux_binprm *bprm, ...@@ -710,7 +713,8 @@ static int load_flat_file(struct linux_binprm *bprm,
if (IS_ERR_VALUE(result)) { if (IS_ERR_VALUE(result)) {
ret = result; ret = result;
pr_err("Unable to read code+data+bss, errno %d\n", ret); pr_err("Unable to read code+data+bss, errno %d\n", ret);
vm_munmap(textpos, text_len + data_len + extra); vm_munmap(textpos, text_len + data_len + extra +
MAX_SHARED_LIBS * sizeof(u32));
goto err; goto err;
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment