In commit:
eab09532d4 ("binfmt_elf: use ELF_ET_DYN_BASE only for PIE")
... PIE programs are loaded offset from ELF_ET_DYN_BASE, and its map
has been set as MAP_FIXED. Only dynamic loader will be mapped from
below mm->mmap_base (E.g "./ld.so someprog"), and need take account
of the need to allocate sufficient space for the entire loader image
to avoid the case that the first PT_LOAD segment is mapped below
mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped
above mm->mmap_base into the area that is supposed to be the "gap"
between the stack and mm->mmap_base.
Whether it's harmless or not, we should not allow program to map above
mm->mmap_base. So here change to get the total_size only for dynamic
loader in load_elf_binary().
Signed-off-by: Baoquan He <bhe@xxxxxxxxxx>
---
fs/binfmt_elf.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 72b7ecba7ead..d7a8a53a6f18 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -967,9 +967,17 @@ static int load_elf_binary(struct linux_binprm *bprm)
if (current->flags & PF_RANDOMIZE)
load_bias += arch_mmap_rnd();
elf_flags |= MAP_FIXED;
- } else
+ } else {
load_bias = 0;
+ total_size = total_mapping_size(elf_phdata,
+ loc->elf_ex.e_phnum);
+ if (!total_size) {
+ retval = -EINVAL;
+ goto out_free_dentry;
+ }
+ }
+
/*
* Since load_bias is used for all subsequent loading
* calculations, we must lower it by the first vaddr
@@ -978,13 +986,6 @@ static int load_elf_binary(struct linux_binprm *bprm)
* is then page aligned.
*/
load_bias = ELF_PAGESTART(load_bias - vaddr);
-
- total_size = total_mapping_size(elf_phdata,
- loc->elf_ex.e_phnum);
- if (!total_size) {
- retval = -EINVAL;
- goto out_free_dentry;
- }
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
--
2.5.5
