Attachment 32728 Details for Bug 73837

[patch] load_elf_library-kfree-fix.patch

load_elf_library-kfree-fix.patch (text/plain), 2.70 KB, created by Ludwig Nussel on 2005-03-24 10:15:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2005-03-24 10:15:22 UTC

Size: 2.70 KB

patch

obsolete

>
>From: Herbert Xu <herbert@gondor.apana.org.au>
>
>Yichen Xie <yxie@cs.stanford.edu> points out that load_elf_library can
>modify `elf_phdata' before freeing it.
>
>Signed-off-by: Andrew Morton <akpm@osdl.org>
>---
>
> 25-akpm/fs/binfmt_elf.c |   30 +++++++++++++++++-------------
> 1 files changed, 17 insertions(+), 13 deletions(-)
>
>diff -puN fs/binfmt_elf.c~load_elf_library-kfree-fix fs/binfmt_elf.c
>--- 25/fs/binfmt_elf.c~load_elf_library-kfree-fix	2005-03-20 16:56:41.000000000 -0800
>+++ 25-akpm/fs/binfmt_elf.c	2005-03-20 16:56:41.000000000 -0800
>@@ -1026,6 +1026,7 @@ out_free_ph:
> static int load_elf_library(struct file *file)
> {
> 	struct elf_phdr *elf_phdata;
>+	struct elf_phdr *eppnt;
> 	unsigned long elf_bss, bss, len;
> 	int retval, error, i, j;
> 	struct elfhdr elf_ex;
>@@ -1049,44 +1050,47 @@ static int load_elf_library(struct file 
> 	/* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
> 
> 	error = -ENOMEM;
>-	elf_phdata = (struct elf_phdr *) kmalloc(j, GFP_KERNEL);
>+	elf_phdata = kmalloc(j, GFP_KERNEL);
> 	if (!elf_phdata)
> 		goto out;
> 
>+	eppnt = elf_phdata;
> 	error = -ENOEXEC;
>-	retval = kernel_read(file, elf_ex.e_phoff, (char *) elf_phdata, j);
>+	retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
> 	if (retval != j)
> 		goto out_free_ph;
> 
> 	for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
>-		if ((elf_phdata + i)->p_type == PT_LOAD) j++;
>+		if ((eppnt + i)->p_type == PT_LOAD)
>+			j++;
> 	if (j != 1)
> 		goto out_free_ph;
> 
>-	while (elf_phdata->p_type != PT_LOAD) elf_phdata++;
>+	while (eppnt->p_type != PT_LOAD)
>+		eppnt++;
> 
> 	/* Now use mmap to map the library into memory. */
> 	down_write(&current->mm->mmap_sem);
> 	error = do_mmap(file,
>-			ELF_PAGESTART(elf_phdata->p_vaddr),
>-			(elf_phdata->p_filesz +
>-			 ELF_PAGEOFFSET(elf_phdata->p_vaddr)),
>+			ELF_PAGESTART(eppnt->p_vaddr),
>+			(eppnt->p_filesz +
>+			 ELF_PAGEOFFSET(eppnt->p_vaddr)),
> 			PROT_READ | PROT_WRITE | PROT_EXEC,
> 			MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
>-			(elf_phdata->p_offset -
>-			 ELF_PAGEOFFSET(elf_phdata->p_vaddr)));
>+			(eppnt->p_offset -
>+			 ELF_PAGEOFFSET(eppnt->p_vaddr)));
> 	up_write(&current->mm->mmap_sem);
>-	if (error != ELF_PAGESTART(elf_phdata->p_vaddr))
>+	if (error != ELF_PAGESTART(eppnt->p_vaddr))
> 		goto out_free_ph;
> 
>-	elf_bss = elf_phdata->p_vaddr + elf_phdata->p_filesz;
>+	elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
> 	if (padzero(elf_bss)) {
> 		error = -EFAULT;
> 		goto out_free_ph;
> 	}
> 
>-	len = ELF_PAGESTART(elf_phdata->p_filesz + elf_phdata->p_vaddr + ELF_MIN_ALIGN - 1);
>-	bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
>+	len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + ELF_MIN_ALIGN - 1);
>+	bss = eppnt->p_memsz + eppnt->p_vaddr;
> 	if (bss > len) {
> 		down_write(&current->mm->mmap_sem);
> 		do_brk(len, bss - len);
>_

Actions: View | Diff

Attachments on bug 73837: 32728