Attachment 851700 Details for Bug 1050964 – The debugging patch for 3.12.6-300

[patch] The debugging patch for 3.12.6-300

binfmt_elf.c.diff (text/plain), 1.95 KB, created by Denys Vlasenko on 2014-01-17 16:28:31 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Denys Vlasenko

Created: 2014-01-17 16:28:31 UTC

Size: 1.95 KB

patch

obsolete

>--- linux-3.12.6-300.fc18.x86_64/fs/binfmt_elf.c.old	2013-11-04 00:41:51.000000000 +0100
>+++ linux-3.12.6-300.fc18.x86_64/fs/binfmt_elf.c	2014-01-17 13:26:50.418996004 +0100
>@@ -1401,6 +1401,39 @@ static void fill_siginfo_note(struct mem
> 	fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
> }
> 
>+static int bad_memmove(char *dst, char *src, unsigned n, char *data, unsigned size, const char *pfx)
>+{
>+	if (!dst) {
>+		printk(KERN_ERR "%s: BAD MOVE: NULL dst\n", pfx);
>+		return 1;
>+	}
>+	if (!src) {
>+		printk(KERN_ERR "%s: BAD MOVE: NULL src\n", pfx);
>+		return 1;
>+	}
>+	if ((int)n < 0) {
>+		printk(KERN_ERR "%s: BAD MOVE: n=%d\n", pfx, n);
>+		return 1;
>+	}
>+	if ((int)size < 0) {
>+		printk(KERN_ERR "%s: BAD MOVE: size=%d\n", pfx, size);
>+		return 1;
>+	}
>+	if (src < dst) {
>+		printk(KERN_ERR "%s: BAD MOVE: src %p < dst %p\n", pfx, src, dst);
>+		return 1;
>+	}
>+	if (src+n > data+size) {
>+		printk(KERN_ERR "%s: BAD MOVE: src+n %p > data+size %p\n", pfx, src+n, data+size);
>+		return 1;
>+	}
>+	if (dst < data) {
>+		printk(KERN_ERR "%s: BAD MOVE: dst %p < data %p\n", pfx, dst, data);
>+		return 1;
>+	}
>+	return 0;
>+}
>+
> #define MAX_FILE_NOTE_SIZE (4*1024*1024)
> /*
>  * Format of NT_FILE note:
>@@ -1459,6 +1492,10 @@ static int fill_files_note(struct memelf
> 		/* n = strlen(filename) + 1: */
> 		n = (name_curpos + remaining) - filename;
> 		remaining = filename - name_curpos;
>+if (bad_memmove(name_curpos, filename, n, (char*)data, size, "storing")) {
>+ vfree(data);
>+ return -EINVAL;
>+}
> 		memmove(name_curpos, filename, n);
> 		name_curpos += n;
> 
>@@ -1478,6 +1515,12 @@ static int fill_files_note(struct memelf
> 	n = current->mm->map_count - count;
> 	if (n != 0) {
> 		unsigned shift_bytes = n * 3 * sizeof(data[0]);
>+if (bad_memmove(name_base - shift_bytes, name_base,
>+			name_curpos - name_base,
>+		(char*)data, size, "final_fix")) {
>+ vfree(data);
>+ return -EINVAL;
>+}
> 		memmove(name_base - shift_bytes, name_base,
> 			name_curpos - name_base);
> 		name_curpos -= shift_bytes;

Actions: View | Diff

Attachments on bug 1050964: 851700 | 852718 | 853096 | 859160 | 859769