On Thu, 17 Mar 2022 12:20:13 -0700, Rick Edgecombe wrote:
> In fill_thread_core_info() the ptrace accessible registers are collected
> to be written out as notes in a core file. The note array is allocated
> from a size calculated by iterating the user regset view, and counting the
> regsets that have a non-zero core_note_type. However, this only allows for
> there to be non-zero core_note_type at the end of the regset view. If
> there are any gaps in the middle, fill_thread_core_info() will overflow the
> note allocation, as it iterates over the size of the view and the
> allocation would be smaller than that.
>
> [...]
Applied to for-next/execve, thanks!
[3/3] elf: Don't write past end of notes for regset gap
https://git.kernel.org/kees/c/dd664099002d
--
Kees Cook
