diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2009-02-06 18:10:04 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-02-06 18:10:04 -0800 |
| commit | 1d87b0d388c65feb890f1e0aa832338a33d0760f (patch) | |
| tree | ca1980ce84f2fb1bc7952738e32f9657dc4d0154 /fs | |
| parent | d4cf109f05ff04c6f5065c3e14165ef01a57dd53 (diff) | |
| parent | 92dc07b1f988e8c237a38e23be660b9b8533e6fd (diff) | |
| download | linux-3.10-1d87b0d388c65feb890f1e0aa832338a33d0760f.tar.gz linux-3.10-1d87b0d388c65feb890f1e0aa832338a33d0760f.tar.bz2 linux-3.10-1d87b0d388c65feb890f1e0aa832338a33d0760f.zip | |
Merge branch 'to-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/frob/linux-2.6-roland
* 'to-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/frob/linux-2.6-roland:
elf core dump: fix get_user use
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/binfmt_elf.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index e3ff2b9e602..33b7235f853 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -1208,9 +1208,11 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma, * check for an ELF header. If we find one, dump the first page to * aid in determining what was mapped here. */ - if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) { + if (FILTER(ELF_HEADERS) && + vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) { u32 __user *header = (u32 __user *) vma->vm_start; u32 word; + mm_segment_t fs = get_fs(); /* * Doing it this way gets the constant folded by GCC. */ @@ -1223,7 +1225,15 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma, magic.elfmag[EI_MAG1] = ELFMAG1; magic.elfmag[EI_MAG2] = ELFMAG2; magic.elfmag[EI_MAG3] = ELFMAG3; - if (get_user(word, header) == 0 && word == magic.cmp) + /* + * Switch to the user "segment" for get_user(), + * then put back what elf_core_dump() had in place. + */ + set_fs(USER_DS); + if (unlikely(get_user(word, header))) + word = 0; + set_fs(fs); + if (word == magic.cmp) return PAGE_SIZE; } |