From: Greg Kroah-Hartman Date: Mon, 9 Feb 2009 16:25:00 +0000 (-0800) Subject: another .28 patch X-Git-Tag: v2.6.27.16~14 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1fb860a77fe2209fe9e5af1a15f7ded68c6eeec6;p=thirdparty%2Fkernel%2Fstable-queue.git another .28 patch --- diff --git a/queue-2.6.28/elf-core-dump-fix-get_user-use.patch b/queue-2.6.28/elf-core-dump-fix-get_user-use.patch new file mode 100644 index 00000000000..053952cca1d --- /dev/null +++ b/queue-2.6.28/elf-core-dump-fix-get_user-use.patch @@ -0,0 +1,58 @@ +From 92dc07b1f988e8c237a38e23be660b9b8533e6fd Mon Sep 17 00:00:00 2001 +From: Roland McGrath +Date: Fri, 6 Feb 2009 17:34:07 -0800 +Subject: elf core dump: fix get_user use + +From: Roland McGrath + +commit 92dc07b1f988e8c237a38e23be660b9b8533e6fd upstream. + +The elf_core_dump() code does its work with set_fs(KERNEL_DS) in force, +so vma_dump_size() needs to switch back with set_fs(USER_DS) to safely +use get_user() for a normal user-space address. + +Checking for VM_READ optimizes out the case where get_user() would fail +anyway. The vm_file check here was already superfluous given the control +flow earlier in the function, so that is a cleanup/optimization unrelated +to other changes but an obvious and trivial one. + +Reported-by: Gerald Schaefer +Signed-off-by: Roland McGrath +Signed-off-by: Greg Kroah-Hartman + +--- + fs/binfmt_elf.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1196,9 +1196,11 @@ static unsigned long vma_dump_size(struc + * check for an ELF header. If we find one, dump the first page to + * aid in determining what was mapped here. + */ +- if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) { ++ if (FILTER(ELF_HEADERS) && ++ vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) { + u32 __user *header = (u32 __user *) vma->vm_start; + u32 word; ++ mm_segment_t fs = get_fs(); + /* + * Doing it this way gets the constant folded by GCC. + */ +@@ -1211,7 +1213,15 @@ static unsigned long vma_dump_size(struc + magic.elfmag[EI_MAG1] = ELFMAG1; + magic.elfmag[EI_MAG2] = ELFMAG2; + magic.elfmag[EI_MAG3] = ELFMAG3; +- if (get_user(word, header) == 0 && word == magic.cmp) ++ /* ++ * Switch to the user "segment" for get_user(), ++ * then put back what elf_core_dump() had in place. ++ */ ++ set_fs(USER_DS); ++ if (unlikely(get_user(word, header))) ++ word = 0; ++ set_fs(fs); ++ if (word == magic.cmp) + return PAGE_SIZE; + } + diff --git a/queue-2.6.28/series b/queue-2.6.28/series index 81c48cd57c9..b99568044c6 100644 --- a/queue-2.6.28/series +++ b/queue-2.6.28/series @@ -40,3 +40,4 @@ seq_file-fix-big-enough-lseek-read.patch serial-set-correct-baud_base-for-oxford-semiconductor-ltd-exsys-ex-41092-dual-16950-serial-adapter.patch add-support-for-8-port-rs-232-mic-3620-from-advantech.patch mm-fix-error-case-in-mlock-downgrade-reversion.patch +elf-core-dump-fix-get_user-use.patch