From: Cyrill Gorcunov <gorcunov@gmail.com>
To: LKML <linux-kernel@vger.kernel.org>
Cc: Andrey Vagin <avagin@gmail.com>,
Dmitry Safonov <0x7f454c46@gmail.com>,
Pavel Emelyanov <xemul@virtuozzo.com>,
Andrew Morton <akpm@linuxfoundation.org>
Subject: [PATCH -next] prctl: Fix false positive in validate_prctl_map
Date: Mon, 8 Apr 2019 17:35:54 +0300 [thread overview]
Message-ID: <20190408143554.GY1421@uranus.lan> (raw)
While validating new map we require the @start_data to be strictly less
than @end_data, which is fine for regular applications (this is why this
nit didn't trigger for that long). These members are set from executable
loaders such as elf halders, still it is pretty valid to have a loadable
data section with zero size in file, in such case the start_data is equal
to end_data once kernel loader finishes.
In result when we'are trying to restore such program the procedure fails
and kernel returns -EINVAL. From the image dump of a program:
| "mm_start_code": "0x400000",
| "mm_end_code": "0x8f5fb4",
| "mm_start_data": "0xf1bfb0",
| "mm_end_data": "0xf1bfb0",
Thus we need to change validate_prctl_map from strictly less to less or
equal operator use.
Fixes: f606b77f1a9e362451aca8f81d8f36a3a112139e
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
CC: Andrey Vagin <avagin@gmail.com>
CC: Dmitry Safonov <0x7f454c46@gmail.com>
CC: Pavel Emelyanov <xemul@virtuozzo.com>
CC: Andrew Morton <akpm@linuxfoundation.org>
---
I don't consider this issue as a critical one, since it triggered first
time for in more than 4 years period (and report came from a proprietary
program).
kernel/sys.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Index: linux-next.git/kernel/sys.c
===================================================================
--- linux-next.git.orig/kernel/sys.c
+++ linux-next.git/kernel/sys.c
@@ -1924,7 +1924,7 @@ static int validate_prctl_map(struct prc
((unsigned long)prctl_map->__m1 __op \
(unsigned long)prctl_map->__m2) ? 0 : -EINVAL
error = __prctl_check_order(start_code, <, end_code);
- error |= __prctl_check_order(start_data, <, end_data);
+ error |= __prctl_check_order(start_data,<=, end_data);
error |= __prctl_check_order(start_brk, <=, brk);
error |= __prctl_check_order(arg_start, <=, arg_end);
error |= __prctl_check_order(env_start, <=, env_end);
reply other threads:[~2019-04-08 14:35 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190408143554.GY1421@uranus.lan \
--to=gorcunov@gmail.com \
--cc=0x7f454c46@gmail.com \
--cc=akpm@linuxfoundation.org \
--cc=avagin@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=xemul@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox