Commit 92dc07b1 authored by Roland McGrath's avatar Roland McGrath

elf core dump: fix get_user use

The elf_core_dump() code does its work with set_fs(KERNEL_DS) in force,
so vma_dump_size() needs to switch back with set_fs(USER_DS) to safely
use get_user() for a normal user-space address.

Checking for VM_READ optimizes out the case where get_user() would fail
anyway.  The vm_file check here was already superfluous given the control
flow earlier in the function, so that is a cleanup/optimization unrelated
to other changes but an obvious and trivial one.
Reported-by: default avatarGerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: default avatarRoland McGrath <roland@redhat.com>
parent 6cec5083
...@@ -1208,9 +1208,11 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma, ...@@ -1208,9 +1208,11 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
* check for an ELF header. If we find one, dump the first page to * check for an ELF header. If we find one, dump the first page to
* aid in determining what was mapped here. * aid in determining what was mapped here.
*/ */
if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) { if (FILTER(ELF_HEADERS) &&
vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
u32 __user *header = (u32 __user *) vma->vm_start; u32 __user *header = (u32 __user *) vma->vm_start;
u32 word; u32 word;
mm_segment_t fs = get_fs();
/* /*
* Doing it this way gets the constant folded by GCC. * Doing it this way gets the constant folded by GCC.
*/ */
...@@ -1223,7 +1225,15 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma, ...@@ -1223,7 +1225,15 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
magic.elfmag[EI_MAG1] = ELFMAG1; magic.elfmag[EI_MAG1] = ELFMAG1;
magic.elfmag[EI_MAG2] = ELFMAG2; magic.elfmag[EI_MAG2] = ELFMAG2;
magic.elfmag[EI_MAG3] = ELFMAG3; magic.elfmag[EI_MAG3] = ELFMAG3;
if (get_user(word, header) == 0 && word == magic.cmp) /*
* Switch to the user "segment" for get_user(),
* then put back what elf_core_dump() had in place.
*/
set_fs(USER_DS);
if (unlikely(get_user(word, header)))
word = 0;
set_fs(fs);
if (word == magic.cmp)
return PAGE_SIZE; return PAGE_SIZE;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment