p_memsz member of program header entry with PT_NOTE type needs to have
size of the corresponding ELF note segment. Currently, vmcoreinfo
exports data part only. If vmcoreinfo reachs vmcoreinfo_max_size, then
in merge_note_headers_elf{32,64}, empty ELF note header cannot be
found or buffer overrun can happen.
Note: kexec-tools assigns PAGE_SIZE to p_memsz for other ELF note
types. Due to the above reason, the same issue occurs if actual ELF
note data exceeds (PAGE_SIZE - 2 * KEXEC_NOTE_HEAD_BYTES).
Signed-off-by: HATAYAMA Daisuke <d.hatayama at jp.fujitsu.com>
---
kernel/ksysfs.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
index 6ada93c..97d2763 100644
--- a/kernel/ksysfs.c
+++ b/kernel/ksysfs.c
@@ -126,7 +126,7 @@ static ssize_t vmcoreinfo_show(struct kobject *kobj,
{
return sprintf(buf, "%lx %x\n",
paddr_vmcoreinfo_note(),
- (unsigned int)vmcoreinfo_max_size);
+ (unsigned int)sizeof(vmcoreinfo_note));
}
KERNEL_ATTR_RO(vmcoreinfo);
