Messages in this thread | | | From | Rob Landley <> | Subject | Question about binfmt_elf.c | Date | Fri, 16 Jul 2010 15:12:39 -0500 |
| |
Could somebody please update this comment to explain why fiddling with strangely protected bss is _not_ an easy way to leak arbitrary amounts of uninitalized kernel memory (with whatever previous contents they have) to userspace?
nbyte = ELF_PAGEOFFSET(elf_bss); if (nbyte) { nbyte = ELF_MIN_ALIGN - nbyte; if (nbyte > elf_brk - elf_bss) nbyte = elf_brk - elf_bss; if (clear_user((void __user *)elf_bss + load_bias, nbyte)) { /* * This bss-zeroing can fail if the ELF * file specifies odd protections. So * we don't check the return value */ } }
Just curious. Reading through the code and trying to understand it...
Rob -- GPLv3: as worthy a successor as The Phantom Meanace, as timely as Duke Nukem Forever, and as welcome as New Coke.
| |