Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1d87b0d3 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'to-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/frob/linux-2.6-roland 

* 'to-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/frob/linux-2.6-roland:
  elf core dump: fix get_user use
parents d4cf109f 92dc07b1

fs/binfmt_elf.c

+12 −2
Original line number Diff line number Diff line
@@ -1208,9 +1208,11 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma, 
	 * check for an ELF header.  If we find one, dump the first page to

	 * aid in determining what was mapped here.

	 */

	if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {

	if (FILTER(ELF_HEADERS) &&

	    vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {

		u32 __user *header = (u32 __user *) vma->vm_start;

		u32 word;

		mm_segment_t fs = get_fs();

		/*

		 * Doing it this way gets the constant folded by GCC.

		 */
@@ -1223,7 +1225,15 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma, 
		magic.elfmag[EI_MAG1] = ELFMAG1;

		magic.elfmag[EI_MAG2] = ELFMAG2;

		magic.elfmag[EI_MAG3] = ELFMAG3;

		if (get_user(word, header) == 0 && word == magic.cmp)

		/*

		 * Switch to the user "segment" for get_user(),

		 * then put back what elf_core_dump() had in place.

		 */

		set_fs(USER_DS);

		if (unlikely(get_user(word, header)))

			word = 0;

		set_fs(fs);

		if (word == magic.cmp)

			return PAGE_SIZE;

	}