Attachment 36955 Details for Bug 83222

[patch] elf-core-problem-24.patch

elf-core-problem-24.patch (text/plain), 2.78 KB, created by Marcus Meissner on 2005-05-12 10:53:45 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2005-05-12 10:53:45 UTC

Size: 2.78 KB

patch

obsolete

>Details of how we'll probably fix this (against 2.4.21), from Ernie 
>Petrides:
>
>"Since we already have a fix in proc_pid_cmdline() that relies on a
>zero "arg_end" test, I have extended that approach by initializing
>arg_end, env_start, and env_end to zero and adding the appropriate
>checks in elf_core_dump(), proc_pid_cmdline(), and proc_pid_environ().
>
>I've also added initialization (in a.out) as well to prevent /proc races 
>with a.out process start-up.
>
>I feel this approach is better than setting ending values to starting
>values because we really don't want to execute the user-space access
>logic when the arg/env-space is just in the process of being written
>(i.e., when exec() is racing with /proc access from another task)."
>
>--- linux-2.4.21/fs/binfmt_aout.c.orig
>+++ linux-2.4.21/fs/binfmt_aout.c
>@@ -225,6 +225,9 @@ static unsigned long * create_aout_table
>  #endif
>  	put_user(argc,--sp);
>  	current->mm->arg_start = (unsigned long) p;
>+	current->mm->arg_end = 0UL;
>+	current->mm->env_start = 0UL;
>+	current->mm->env_end = 0UL;
>  	while (argc-->0) {
>  		char c;
>  		put_user(p,argv++);
>--- linux-2.4.21/fs/binfmt_elf.c.orig
>+++ linux-2.4.21/fs/binfmt_elf.c
>@@ -222,6 +222,9 @@ create_elf_tables(char *p, int argc, int
>
>  	__put_user((elf_addr_t)argc,--sp);
>  	current->mm->arg_start = (unsigned long) p;
>+	current->mm->arg_end = 0UL;
>+	current->mm->env_start = 0UL;
>+	current->mm->env_end = 0UL;
>  	while (argc-->0) {
>  		__put_user((elf_caddr_t)(unsigned long)p,argv++);
>  		len = strnlen_user(p, PAGE_SIZE*MAX_ARG_PAGES);
>@@ -1404,7 +1407,7 @@ static int elf_core_dump(long signr, str
>
>  	/* first copy the parameters from user space */
>  	memset(&psinfo, 0, sizeof(psinfo));
>-	{
>+	if (current->mm->arg_end) {
>  		int i, len;
>
>  		len = current->mm->arg_end - current->mm->arg_start;
>--- linux-2.4.21/fs/proc/base.c.orig
>+++ linux-2.4.21/fs/proc/base.c
>@@ -164,11 +164,15 @@ static int proc_pid_environ(struct task_
>
>  	task_lock(task);
>  	mm = task->mm;
>-	if (mm)
>-		atomic_inc(&mm->mm_users);
>+	if (mm) {
>+		if (mm->env_end)
>+			atomic_inc(&mm->mm_users);
>+		else
>+			mm = NULL;
>+	}
>  	task_unlock(task);
>  	if (mm) {
>-		unsigned int len = mm->env_end - mm->env_start;
>+		int len = mm->env_end - mm->env_start;
>  		if (len > PAGE_SIZE)
>  			len = PAGE_SIZE;
>  		res = access_process_vm(task, mm->env_start, buffer, len, 0);
>@@ -205,8 +209,7 @@ static int proc_pid_cmdline(struct task_
>
>  		// If the nul at the end of args has been overwritten, then
>  		// assume application is using setproctitle(3).
>-		if ( res > 0 && buffer[res-1] != '\0' )
>-		{
>+		if (res > 0 && buffer[res-1] != '\0' && mm->env_end) {
>  			len = strnlen( buffer, res );
>  			if ( len < res )
>  			{
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

Actions: View | Diff

Attachments on bug 83222: 36776 | 36777 | 36928 | 36955 | 37074