Attachment 37074 Details for Bug 83222

[patch] Proposed patch for 2.4

elf-coredump (text/plain), 3.23 KB, created by Olaf Kirch on 2005-05-13 11:12:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Olaf Kirch

Created: 2005-05-13 11:12:56 UTC

Size: 3.23 KB

patch

obsolete

>Details of how we'll probably fix this (against 2.4.21), from Ernie 
>Petrides:
>
>"Since we already have a fix in proc_pid_cmdline() that relies on a
>zero "arg_end" test, I have extended that approach by initializing
>arg_end, env_start, and env_end to zero and adding the appropriate
>checks in elf_core_dump(), proc_pid_cmdline(), and proc_pid_environ().
>
>I've also added initialization (in a.out) as well to prevent /proc races 
>with a.out process start-up.
>
>I feel this approach is better than setting ending values to starting
>values because we really don't want to execute the user-space access
>logic when the arg/env-space is just in the process of being written
>(i.e., when exec() is racing with /proc access from another task)."
>
>Index: linux-2.4.21/fs/binfmt_aout.c
>===================================================================
>--- linux-2.4.21.orig/fs/binfmt_aout.c	2005-05-09 11:51:35.000000000 +0200
>+++ linux-2.4.21/fs/binfmt_aout.c	2005-05-13 13:06:58.000000000 +0200
>@@ -230,6 +230,9 @@ static unsigned long * create_aout_table
> #endif
> 	put_user(argc,--sp);
> 	current->mm->arg_start = (unsigned long) p;
>+	current->mm->arg_end = 0UL;
>+	current->mm->env_start = 0UL;
>+	current->mm->env_end = 0UL;
> 	while (argc-->0) {
> 		char c;
> 		put_user(p,argv++);
>Index: linux-2.4.21/fs/binfmt_elf.c
>===================================================================
>--- linux-2.4.21.orig/fs/binfmt_elf.c	2005-05-09 11:51:36.000000000 +0200
>+++ linux-2.4.21/fs/binfmt_elf.c	2005-05-13 13:07:57.000000000 +0200
>@@ -216,6 +216,9 @@ create_elf_tables(char *p, int argc, int
> 
> 	__put_user((elf_addr_t)argc,--sp);
> 	current->mm->arg_start = (unsigned long) p;
>+	current->mm->arg_end = 0UL;
>+	current->mm->env_start = 0UL;
>+	current->mm->env_end = 0UL;
> 	while (argc-->0) {
> 		__put_user((elf_caddr_t)(unsigned long)p,argv++);
> 		len = strnlen_user(p, PAGE_SIZE*MAX_ARG_PAGES);
>@@ -1104,8 +1107,8 @@ static int elf_core_dump(long signr, str
> 
> 	/* first copy the parameters from user space */
> 	memset(&psinfo, 0, sizeof(psinfo));
>-	{
>-		int i, len;
>+	if (current->mm->arg_end) {
>+		unsigned int int i, len;
> 
> 		len = current->mm->arg_end - current->mm->arg_start;
> 		if (len >= ELF_PRARGSZ)
>Index: linux-2.4.21/fs/proc/base.c
>===================================================================
>--- linux-2.4.21.orig/fs/proc/base.c	2005-05-09 11:51:36.000000000 +0200
>+++ linux-2.4.21/fs/proc/base.c	2005-05-13 13:09:49.000000000 +0200
>@@ -174,11 +174,15 @@ static int proc_pid_environ(struct task_
> 
> 	task_lock(task);
> 	mm = task->mm;
>-	if (mm)
>-		atomic_inc(&mm->mm_users);
>+	if (mm) {
>+ 		if (mm->env_end)
>+ 			atomic_inc(&mm->mm_users);
>+ 		else
>+ 			mm = NULL;
>+ 	}
> 	task_unlock(task);
> 	if (mm && mm->env_start && mm->env_start < mm->env_end) {
>-		int len = mm->env_end - mm->env_start;
>+		unsigned int len = mm->env_end - mm->env_start;
> 		if (len > PAGE_SIZE)
> 			len = PAGE_SIZE;
> 		res = access_process_vm(task, mm->env_start, buffer, len, 0);
>@@ -218,8 +222,7 @@ static int proc_pid_cmdline(struct task_
> 		// If the nul at the end of args has been overwritten, then
> 		// assume application is using setproctitle(3).
> 
>-		if ( res > 0 && buffer[res-1] != '\0' )
>-		{
>+		if ( res > 0 && buffer[res-1] != '\0' && mm->env_end) {
> 			len = strnlen( buffer, res );
> 			if ( len < res )
> 			{

Actions: View | Diff

Attachments on bug 83222: 36776 | 36777 | 36928 | 36955 | 37074