diff options
| author | Nicolas Pitre <nicolas.pitre@linaro.org> | 2017-08-16 18:56:14 -0400 |
|---|---|---|
| committer | Nicolas Pitre <nicolas.pitre@linaro.org> | 2017-09-10 19:31:47 -0400 |
| commit | cdf38888ed30523b1a6ee199449a86dbd1d864ce (patch) | |
| tree | eea19beef8369b6730a3927e4ea70787b93bf2ed | |
| parent | 4755200b6b116dbf6d5545427e8a2cf58194ba6b (diff) | |
| download | op-kernel-dev-cdf38888ed30523b1a6ee199449a86dbd1d864ce.zip op-kernel-dev-cdf38888ed30523b1a6ee199449a86dbd1d864ce.tar.gz | |
binfmt_elf_fdpic: fix crash on MMU system with dynamic binaries
In elf_fdpic_map_file() there is a test to ensure the dynamic section in
user space is properly terminated. However it does so by dereferencing
a user address directly. Add proper user space accessor.
Signed-off-by: Nicolas Pitre <nico@linaro.org>
Acked-by: Mickael GUENE <mickael.guene@st.com>
Tested-by: Vincent Abriou <vincent.abriou@st.com>
Tested-by: Andras Szemzo <szemzo.andras@gmail.com>
| -rw-r--r-- | fs/binfmt_elf_fdpic.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c index 692e2a1..6a56dea 100644 --- a/fs/binfmt_elf_fdpic.c +++ b/fs/binfmt_elf_fdpic.c @@ -835,6 +835,9 @@ static int elf_fdpic_map_file(struct elf_fdpic_params *params, if (phdr->p_vaddr >= seg->p_vaddr && phdr->p_vaddr + phdr->p_memsz <= seg->p_vaddr + seg->p_memsz) { + Elf32_Dyn __user *dyn; + Elf32_Sword d_tag; + params->dynamic_addr = (phdr->p_vaddr - seg->p_vaddr) + seg->addr; @@ -847,8 +850,9 @@ static int elf_fdpic_map_file(struct elf_fdpic_params *params, goto dynamic_error; tmp = phdr->p_memsz / sizeof(Elf32_Dyn); - if (((Elf32_Dyn *) - params->dynamic_addr)[tmp - 1].d_tag != 0) + dyn = (Elf32_Dyn __user *)params->dynamic_addr; + __get_user(d_tag, &dyn[tmp - 1].d_tag); + if (d_tag != 0) goto dynamic_error; break; } |
