Attachment 852718 Details for Bug 1050964 – New debugging patch

[patch] New debugging patch

binfmt_elf.c.v2.diff (text/plain), 2.66 KB, created by Denys Vlasenko on 2014-01-20 11:43:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Denys Vlasenko

Created: 2014-01-20 11:43:12 UTC

Size: 2.66 KB

patch

obsolete

>--- linux-3.12.6-300.fc18.x86_64/fs/binfmt_elf.c.old	2013-11-04 00:41:51.000000000 +0100
>+++ linux-3.12.6-300.fc18.x86_64/fs/binfmt_elf.c	2014-01-20 11:17:53.620229438 +0100
>@@ -1401,6 +1401,39 @@ static void fill_siginfo_note(struct mem
> 	fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
> }
> 
>+static int bad_memmove(char *dst, char *src, unsigned n, char *data, unsigned size, const char *pfx)
>+{
>+	if (!dst) {
>+		printk(KERN_ERR "%s: BAD MOVE: NULL dst\n", pfx);
>+		return 1;
>+	}
>+	if (!src) {
>+		printk(KERN_ERR "%s: BAD MOVE: NULL src\n", pfx);
>+		return 1;
>+	}
>+	if ((int)n < 0) {
>+		printk(KERN_ERR "%s: BAD MOVE: n=%d\n", pfx, n);
>+		return 1;
>+	}
>+	if ((int)size < 0) {
>+		printk(KERN_ERR "%s: BAD MOVE: size=%d\n", pfx, size);
>+		return 1;
>+	}
>+	if (src < dst) {
>+		printk(KERN_ERR "%s: BAD MOVE: src %p < dst %p, n %u\n", pfx, src, dst, n);
>+		return 1;
>+	}
>+	if (src+n > data+size) {
>+		printk(KERN_ERR "%s: BAD MOVE: src+n %p > data+size %p\n", pfx, src+n, data+size);
>+		return 1;
>+	}
>+	if (dst < data) {
>+		printk(KERN_ERR "%s: BAD MOVE: dst %p < data %p\n", pfx, dst, data);
>+		return 1;
>+	}
>+	return 0;
>+}
>+
> #define MAX_FILE_NOTE_SIZE (4*1024*1024)
> /*
>  * Format of NT_FILE note:
>@@ -1445,6 +1478,11 @@ static int fill_files_note(struct memelf
> 		file = vma->vm_file;
> 		if (!file)
> 			continue;
>+if ((int)remaining < 0) {
>+ printk(KERN_ERR " BAD1 remaining %d\n", (int)remaining);
>+ vfree(data);
>+ return -EINVAL;
>+}
> 		filename = d_path(&file->f_path, name_curpos, remaining);
> 		if (IS_ERR(filename)) {
> 			if (PTR_ERR(filename) == -ENAMETOOLONG) {
>@@ -1458,7 +1496,18 @@ static int fill_files_note(struct memelf
> 		/* d_path() fills at the end, move name down */
> 		/* n = strlen(filename) + 1: */
> 		n = (name_curpos + remaining) - filename;
>-		remaining = filename - name_curpos;
>+//		remaining = filename - name_curpos;
>+if (bad_memmove(name_curpos, filename, n, (char*)data, size, "storing")) {
>+ printk(KERN_ERR " was d_path(%p, %p, %u)\n", &file->f_path, name_curpos, remaining);
>+ vfree(data);
>+ return -EINVAL;
>+}
>+		remaining = filename - name_curpos; //
>+if ((int)remaining < 0) {
>+ printk(KERN_ERR " BAD2 remaining %d\n", (int)remaining);
>+ vfree(data);
>+ return -EINVAL;
>+}
> 		memmove(name_curpos, filename, n);
> 		name_curpos += n;
> 
>@@ -1478,6 +1527,12 @@ static int fill_files_note(struct memelf
> 	n = current->mm->map_count - count;
> 	if (n != 0) {
> 		unsigned shift_bytes = n * 3 * sizeof(data[0]);
>+if (bad_memmove(name_base - shift_bytes, name_base,
>+			name_curpos - name_base,
>+		(char*)data, size, "final_fix")) {
>+ vfree(data);
>+ return -EINVAL;
>+}
> 		memmove(name_base - shift_bytes, name_base,
> 			name_curpos - name_base);
> 		name_curpos -= shift_bytes;

Actions: View | Diff

Attachments on bug 1050964: 851700 | 852718 | 853096 | 859160 | 859769