[lkml]   [2009]   [Feb]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [BUG] binfmt_elf: get_user() called in vma_dump_size() after set_fs(KERNEL_DS)
    > Yes, I suspect just surrounding the load with set_fs(USER_DS) and then 
    > set_fs(KERNEL_DS) to put it back is likely the right thing to do.


    > The address is "safe" in that it does come from the vma, but we obviously
    > do play games with things like the call gate mappings etc.

    gate_vma has VM_ALWAYSDUMP so it never sees this whole path anyway.
    I doubt there is any actual case. But, point taken.

    > Should we also perhaps do this only if the vma is marked readable and
    > executable? That way we could avoid taking unnecessary faults there.
    > Probably doesn't really matter.

    I'm sure it doesn't really matter. But, just to say it all: Requiring
    VM_EXEC would actually exclude some valid cases. Even requiring VM_READ is
    less than perfect as far as pedantic semantics go--but there is no reason
    not to check it since its lack rules out get_user() actually working
    anyway. I already chose that trade-off since get_user() here is so much
    cheaper than get_user_pages(). The core dump from a stray
    "mprotect(0,1UL<<32,PROT_NONE)" (i.e. presumably actually one with some
    arithmetic error) would be useful if we made the check work without
    VM_READ, but oh well.


     \ /
      Last update: 2009-02-07 02:59    [W:0.020 / U:6.252 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site