another .28 patch

diff --git a/queue-2.6.28/elf-core-dump-fix-get_user-use.patch b/queue-2.6.28/elf-core-dump-fix-get_user-use.patch
new file mode 100644 (file)
index 0000000..053952c
--- /dev/null
+++ b/queue-2.6.28/elf-core-dump-fix-get_user-use.patch
@@ -0,0 +1,58 @@
+From 92dc07b1f988e8c237a38e23be660b9b8533e6fd Mon Sep 17 00:00:00 2001
+From: Roland McGrath <roland@redhat.com>
+Date: Fri, 6 Feb 2009 17:34:07 -0800
+Subject: elf core dump: fix get_user use
+
+From: Roland McGrath <roland@redhat.com>
+
+commit 92dc07b1f988e8c237a38e23be660b9b8533e6fd upstream.
+
+The elf_core_dump() code does its work with set_fs(KERNEL_DS) in force,
+so vma_dump_size() needs to switch back with set_fs(USER_DS) to safely
+use get_user() for a normal user-space address.
+
+Checking for VM_READ optimizes out the case where get_user() would fail
+anyway.  The vm_file check here was already superfluous given the control
+flow earlier in the function, so that is a cleanup/optimization unrelated
+to other changes but an obvious and trivial one.
+
+Reported-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Roland McGrath <roland@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/binfmt_elf.c |   14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1196,9 +1196,11 @@ static unsigned long vma_dump_size(struc
+        * check for an ELF header.  If we find one, dump the first page to
+        * aid in determining what was mapped here.
+        */
+-      if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {
++      if (FILTER(ELF_HEADERS) &&
++          vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
+               u32 __user *header = (u32 __user *) vma->vm_start;
+               u32 word;
++              mm_segment_t fs = get_fs();
+               /*
+                * Doing it this way gets the constant folded by GCC.
+                */
+@@ -1211,7 +1213,15 @@ static unsigned long vma_dump_size(struc
+               magic.elfmag[EI_MAG1] = ELFMAG1;
+               magic.elfmag[EI_MAG2] = ELFMAG2;
+               magic.elfmag[EI_MAG3] = ELFMAG3;
+-              if (get_user(word, header) == 0 && word == magic.cmp)
++              /*
++               * Switch to the user "segment" for get_user(),
++               * then put back what elf_core_dump() had in place.
++               */
++              set_fs(USER_DS);
++              if (unlikely(get_user(word, header)))
++                      word = 0;
++              set_fs(fs);
++              if (word == magic.cmp)
+                       return PAGE_SIZE;
+       }
+ 

diff --git a/queue-2.6.28/series b/queue-2.6.28/series
index 81c48cd57c9840797b3264be4ee5feb24ba8fb68..b99568044c63c6cda4c1a8cb30afcf4e2e0fd51f 100644 (file)
--- a/queue-2.6.28/series
+++ b/queue-2.6.28/series
@@ -40,3 +40,4 @@ seq_file-fix-big-enough-lseek-read.patch
 serial-set-correct-baud_base-for-oxford-semiconductor-ltd-exsys-ex-41092-dual-16950-serial-adapter.patch
 add-support-for-8-port-rs-232-mic-3620-from-advantech.patch
 mm-fix-error-case-in-mlock-downgrade-reversion.patch
+elf-core-dump-fix-get_user-use.patch