From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Max Filippov <jcmvbkbc@gmail.com>,
Greg Ungerer <gerg@linux-m68k.org>
Subject: [PATCH 5.7 15/15] binfmt_flat: revert "binfmt_flat: dont offset the data start"
Date: Wed, 26 Aug 2020 14:02:43 +0200 [thread overview]
Message-ID: <20200826114850.032392369@linuxfoundation.org> (raw)
In-Reply-To: <20200826114849.295321031@linuxfoundation.org>
From: Max Filippov <jcmvbkbc@gmail.com>
commit 2217b982624680d19a80ebb4600d05c8586c4f96 upstream.
binfmt_flat loader uses the gap between text and data to store data
segment pointers for the libraries. Even in the absence of shared
libraries it stores at least one pointer to the executable's own data
segment. Text and data can go back to back in the flat binary image and
without offsetting data segment last few instructions in the text
segment may get corrupted by the data segment pointer.
Fix it by reverting commit a2357223c50a ("binfmt_flat: don't offset the
data start").
Cc: stable@vger.kernel.org
Fixes: a2357223c50a ("binfmt_flat: don't offset the data start")
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/binfmt_flat.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -571,7 +571,7 @@ static int load_flat_file(struct linux_b
goto err;
}
- len = data_len + extra;
+ len = data_len + extra + MAX_SHARED_LIBS * sizeof(unsigned long);
len = PAGE_ALIGN(len);
realdatastart = vm_mmap(NULL, 0, len,
PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 0);
@@ -585,7 +585,9 @@ static int load_flat_file(struct linux_b
vm_munmap(textpos, text_len);
goto err;
}
- datapos = ALIGN(realdatastart, FLAT_DATA_ALIGN);
+ datapos = ALIGN(realdatastart +
+ MAX_SHARED_LIBS * sizeof(unsigned long),
+ FLAT_DATA_ALIGN);
pr_debug("Allocated data+bss+stack (%u bytes): %lx\n",
data_len + bss_len + stack_len, datapos);
@@ -615,7 +617,7 @@ static int load_flat_file(struct linux_b
memp_size = len;
} else {
- len = text_len + data_len + extra;
+ len = text_len + data_len + extra + MAX_SHARED_LIBS * sizeof(u32);
len = PAGE_ALIGN(len);
textpos = vm_mmap(NULL, 0, len,
PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE, 0);
@@ -630,7 +632,9 @@ static int load_flat_file(struct linux_b
}
realdatastart = textpos + ntohl(hdr->data_start);
- datapos = ALIGN(realdatastart, FLAT_DATA_ALIGN);
+ datapos = ALIGN(realdatastart +
+ MAX_SHARED_LIBS * sizeof(u32),
+ FLAT_DATA_ALIGN);
reloc = (__be32 __user *)
(datapos + (ntohl(hdr->reloc_start) - text_len));
@@ -647,9 +651,8 @@ static int load_flat_file(struct linux_b
(text_len + full_data
- sizeof(struct flat_hdr)),
0);
- if (datapos != realdatastart)
- memmove((void *)datapos, (void *)realdatastart,
- full_data);
+ memmove((void *) datapos, (void *) realdatastart,
+ full_data);
#else
/*
* This is used on MMU systems mainly for testing.
@@ -705,7 +708,8 @@ static int load_flat_file(struct linux_b
if (IS_ERR_VALUE(result)) {
ret = result;
pr_err("Unable to read code+data+bss, errno %d\n", ret);
- vm_munmap(textpos, text_len + data_len + extra);
+ vm_munmap(textpos, text_len + data_len + extra +
+ MAX_SHARED_LIBS * sizeof(u32));
goto err;
}
}
next prev parent reply other threads:[~2020-08-26 12:05 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-26 12:02 [PATCH 5.7 00/15] 5.7.19-rc1 review Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 01/15] gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 02/15] net: Fix potential wrong skb->protocol in skb_vlan_untag() Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 03/15] net: nexthop: dont allow empty NHA_GROUP Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 04/15] net: qrtr: fix usage of idr in port assignment to socket Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 05/15] net/sched: act_ct: Fix skb double-free in tcf_ct_handle_fragments() error flow Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 06/15] net: sctp: Fix negotiation of the number of data streams Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 07/15] net/smc: Prevent kernel-infoleak in __smc_diag_dump() Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 08/15] tipc: call rcu_read_lock() in tipc_aead_encrypt_done() Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 09/15] tipc: fix uninit skb->data in tipc_nl_compat_dumpit() Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 10/15] net: ena: Make missed_tx stat incremental Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 11/15] ethtool: Fix preserving of wanted feature bits in netlink interface Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 12/15] ethtool: Account for hw_features " Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 13/15] ethtool: Dont omit the netlink reply if no features were changed Greg Kroah-Hartman
2020-08-26 12:02 ` [PATCH 5.7 14/15] powerpc/64s: Dont init FSCR_DSCR in __init_FSCR() Greg Kroah-Hartman
2020-08-26 12:02 ` Greg Kroah-Hartman [this message]
2020-08-26 14:49 ` [PATCH 5.7 00/15] 5.7.19-rc1 review David K. Kahurani
2020-08-26 14:53 ` Greg KH
2020-08-26 20:48 ` Guenter Roeck
2020-08-27 8:09 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200826114850.032392369@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=gerg@linux-m68k.org \
--cc=jcmvbkbc@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox