.27 patch

diff --git a/queue-2.6.27/elf-core-dump-fix-get_user-use.patch b/queue-2.6.27/elf-core-dump-fix-get_user-use.patch
new file mode 100644 (file)
index 0000000..586474b
--- /dev/null
+++ b/queue-2.6.27/elf-core-dump-fix-get_user-use.patch
@@ -0,0 +1,58 @@
+From 92dc07b1f988e8c237a38e23be660b9b8533e6fd Mon Sep 17 00:00:00 2001
+From: Roland McGrath <roland@redhat.com>
+Date: Fri, 6 Feb 2009 17:34:07 -0800
+Subject: elf core dump: fix get_user use
+
+From: Roland McGrath <roland@redhat.com>
+
+commit 92dc07b1f988e8c237a38e23be660b9b8533e6fd upstream.
+
+The elf_core_dump() code does its work with set_fs(KERNEL_DS) in force,
+so vma_dump_size() needs to switch back with set_fs(USER_DS) to safely
+use get_user() for a normal user-space address.
+
+Checking for VM_READ optimizes out the case where get_user() would fail
+anyway.  The vm_file check here was already superfluous given the control
+flow earlier in the function, so that is a cleanup/optimization unrelated
+to other changes but an obvious and trivial one.
+
+Reported-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Roland McGrath <roland@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/binfmt_elf.c |   14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1188,9 +1188,11 @@ static unsigned long vma_dump_size(struc
+        * check for an ELF header.  If we find one, dump the first page to
+        * aid in determining what was mapped here.
+        */
+-      if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {
++      if (FILTER(ELF_HEADERS) &&
++          vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
+               u32 __user *header = (u32 __user *) vma->vm_start;
+               u32 word;
++              mm_segment_t fs = get_fs();
+               /*
+                * Doing it this way gets the constant folded by GCC.
+                */
+@@ -1203,7 +1205,15 @@ static unsigned long vma_dump_size(struc
+               magic.elfmag[EI_MAG1] = ELFMAG1;
+               magic.elfmag[EI_MAG2] = ELFMAG2;
+               magic.elfmag[EI_MAG3] = ELFMAG3;
+-              if (get_user(word, header) == 0 && word == magic.cmp)
++              /*
++               * Switch to the user "segment" for get_user(),
++               * then put back what elf_core_dump() had in place.
++               */
++              set_fs(USER_DS);
++              if (unlikely(get_user(word, header)))
++                      word = 0;
++              set_fs(fs);
++              if (word == magic.cmp)
+                       return PAGE_SIZE;
+       }
+ 

diff --git a/queue-2.6.27/series b/queue-2.6.27/series
index 9869c420ac9fe08215b75589c4376de9d8469f97..592b487dba0f1359ceedfdf5a66c338f79693a4e 100644 (file)
--- a/queue-2.6.27/series
+++ b/queue-2.6.27/series
@@ -34,3 +34,4 @@ pci-return-error-on-failure-to-read-pci-roms.patch
 seq_file-move-traverse-so-it-can-be-used-from-seq_read.patch
 seq_file-fix-big-enough-lseek-read.patch
 serial-set-correct-baud_base-for-oxford-semiconductor-ltd-exsys-ex-41092-dual-16950-serial-adapter.patch
+elf-core-dump-fix-get_user-use.patch