lkml.org 
[lkml]   [2009]   [Feb]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [BUG] binfmt_elf: get_user() called in vma_dump_size() after set_fs(KERNEL_DS)
Date
> Yes, I suspect just surrounding the load with set_fs(USER_DS) and then 
> set_fs(KERNEL_DS) to put it back is likely the right thing to do.

Agreed.

> The address is "safe" in that it does come from the vma, but we obviously
> do play games with things like the call gate mappings etc.

gate_vma has VM_ALWAYSDUMP so it never sees this whole path anyway.
I doubt there is any actual case. But, point taken.

> Should we also perhaps do this only if the vma is marked readable and
> executable? That way we could avoid taking unnecessary faults there.
>
> Probably doesn't really matter.

I'm sure it doesn't really matter. But, just to say it all: Requiring
VM_EXEC would actually exclude some valid cases. Even requiring VM_READ is
less than perfect as far as pedantic semantics go--but there is no reason
not to check it since its lack rules out get_user() actually working
anyway. I already chose that trade-off since get_user() here is so much
cheaper than get_user_pages(). The core dump from a stray
"mprotect(0,1UL<<32,PROT_NONE)" (i.e. presumably actually one with some
arithmetic error) would be useful if we made the check work without
VM_READ, but oh well.


Thanks,
Roland


\
 
 \ /
  Last update: 2009-02-07 02:59    [from the cache]
©2003-2011 Jasper Spaans