Messages in this thread Patch in this message | | | Date | Tue, 08 Sep 2009 17:26:59 -0700 | From | John Reiser <> | Subject | binfmt_elf PT_INTERP gets EFAULT if no PROT_WRITE |
| |
In fs/binfmt_elf.c, routine load_elf_interp() calls padzero() for .bss even if the PT_LOAD has no PROT_WRITE and no .bss. This generates EFAULT. One easy way to avoid trouble is that a PT_LOAD with no PROT_WRITE should skip the .bss calculation entirely.
Here is a small test case. (Yes, there are other, useful PT_INTERP which have only .text and no .data/.bss.)
----- ptinterp.S _start: .globl _start nop int3 ----- $ gcc -m32 -nostartfiles -nostdlib -o ptinterp ptinterp.S $ gcc -m32 -Wl,--dynamic-linker=ptinterp -o hello hello.c $ ./hello Segmentation fault # during execve() itself
After applying the patch: $ ./hello Trace trap # user-mode execution after execve() finishes
Signed-off-by: John Reiser <jreiser@BitWagon.com>
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index b7c1603..3b9a097 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -488,7 +488,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, * keep track of the largest address we see for this. */ k = load_addr + eppnt->p_vaddr + eppnt->p_filesz; - if (k > elf_bss) + if (k > elf_bss && PROT_WRITE & elf_prot) elf_bss = k;
/* @@ -496,7 +496,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex, * elf_bss and last_bss is the bss section. */ k = load_addr + eppnt->p_memsz + eppnt->p_vaddr; - if (k > last_bss) + if (k > last_bss && PROT_WRITE & elf_prot) last_bss = k; } }
--
| |