Re: Potential bug in fs/binfmt_elf.c?

From: John Reiser (jreiser_at_BitWagon.com)
Date: 03/05/04

  • Next message: Roland Dreier: "ANNOUCE: OpenIB InfiniBand software"
    Date:	Fri, 05 Mar 2004 10:28:07 -0800
    To: mike@navi.cx
    
    

    > When mapping a nobits PT_LOAD segment with a memsize > filesize, the
    > kernel calls set_brk (which in turns calls do_brk) to map and clear the
    > area, but this discards access permissons on the mapping leading to rwx
    > protection. This causes a load failure on systems where the VM cannot
    > reserve swap space for the segment, unless overcommit is active (on many
    > systems it's not on by default).
    [snip]

    I believe that's not the only problem with binfmt_elf. If the total address
    space described by the PT_LOADs is not exactly one contiguous interval, then
    2.6.3 binfmt_elf fills in the gaps with 'prw.' of zero-filled pages, instead
    of the intended "holes" with no mapping at all between isolated PT_LOADs.
    One example is https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=115913

    -- 
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at  http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at  http://www.tux.org/lkml/
    

  • Next message: Roland Dreier: "ANNOUCE: OpenIB InfiniBand software"

    Relevant Pages

    • Re: Kernel bug: mm/rmap.c:483 and related {now 2.6.8}
      ... mapping should be NULL (or at least a pointer into kernel memory). ... say message reappeared twice with identical addresses: ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)
    • Re: [PATCH 17/20] FRV: Better mmap support in uClinux
      ... > I think this could be done at msync, munmap and exit time? ... > flushing the entire mapping, but it's still correct (and POSIX ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)
    • RE: x86-64 dual core mapping
      ... >> It seems right mapping should be ... > Are you sure you dont have a broken SRAT table? ... > processor 2/2 rip ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)
    • Re: Linux-2.4.30-hf3
      ... >> to an oops. ... > Could possibly be exploited by mapping the first page of a program and ... should pass "tty" as NULL to any of the affected functions (that is impossible, ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)
    • Re: How to find out which pages were copied-on-write?
      ... application which is doing an mmap on a file as a MAP_PRIVATE mapping. ... The memory area is then handed to a library which may modify some pages. ... > Yet another feature that I could use if it were available: ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)