Messages in this thread | | | Date | Fri, 6 Feb 2009 13:44:10 -0800 | From | Andrew Morton <> | Subject | Re: [BUG] binfmt_elf: get_user() called in vma_dump_size() after set_fs(KERNEL_DS) |
| |
On Fri, 06 Feb 2009 18:10:35 +0100 Gerald Schaefer <gerald.schaefer@de.ibm.com> wrote:
> Hi, > > elf_core_dump() does a set_fs(KERNEL_DS) and then calls vma_dump_size(), > which uses get_user() to check for an ELF header at vma->vm_start in the > user mapping. This is a bug because vm_start is a user virtual address and > get_user() will fail or even read from a kernel address (KERNEL_DS). > > Maybe a get_user_pages() should be used to get the user data, or a temporary > set_fs(USER_DS)? >
Could use __get_user() to skip the access_ok() check?
We'd need to be sure that the address isn't a kernel address or iomem or something.
| |