Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cdf38888 authored by Nicolas Pitre's avatar Nicolas Pitre
Browse files

binfmt_elf_fdpic: fix crash on MMU system with dynamic binaries 



In elf_fdpic_map_file() there is a test to ensure the dynamic section in
user space is properly terminated. However it does so by dereferencing
a user address directly. Add proper user space accessor.

Signed-off-by: default avatarNicolas Pitre <nico@linaro.org>
Acked-by: default avatarMickael GUENE <mickael.guene@st.com>
Tested-by: default avatarVincent Abriou <vincent.abriou@st.com>
Tested-by: default avatarAndras Szemzo <szemzo.andras@gmail.com>
parent 4755200b

fs/binfmt_elf_fdpic.c

+6 −2
Original line number Diff line number Diff line
@@ -835,6 +835,9 @@ static int elf_fdpic_map_file(struct elf_fdpic_params *params, 
			if (phdr->p_vaddr >= seg->p_vaddr &&

			    phdr->p_vaddr + phdr->p_memsz <=

			    seg->p_vaddr + seg->p_memsz) {

				Elf32_Dyn __user *dyn;

				Elf32_Sword d_tag;



				params->dynamic_addr =

					(phdr->p_vaddr - seg->p_vaddr) +

					seg->addr;
@@ -847,8 +850,9 @@ static int elf_fdpic_map_file(struct elf_fdpic_params *params, 
					goto dynamic_error;



				tmp = phdr->p_memsz / sizeof(Elf32_Dyn);

				if (((Elf32_Dyn *)

				     params->dynamic_addr)[tmp - 1].d_tag != 0)

				dyn = (Elf32_Dyn __user *)params->dynamic_addr;

				__get_user(d_tag, &dyn[tmp - 1].d_tag);

				if (d_tag != 0)

					goto dynamic_error;

				break;

			}