Subject: + vmcore-prevent-pt_note-p_memsz-overflow-during-header-update-v3.patch added to -mm tree To: greg.pearson@xxxxxx,d.hatayama@xxxxxxxxxxxxxx,ebiederm@xxxxxxxxxxxx,holzheu@xxxxxxxxxxxxxxxxxx,vgoyal@xxxxxxxxxx From: akpm@xxxxxxxxxxxxxxxxxxxx Date: Wed, 05 Feb 2014 13:54:29 -0800 The patch titled Subject: vmcore-prevent-pt_note-p_memsz-overflow-during-header-update-v3 has been added to the -mm tree. Its filename is vmcore-prevent-pt_note-p_memsz-overflow-during-header-update-v3.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/vmcore-prevent-pt_note-p_memsz-overflow-during-header-update-v3.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/vmcore-prevent-pt_note-p_memsz-overflow-during-header-update-v3.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Greg Pearson <greg.pearson@xxxxxx> Subject: vmcore-prevent-pt_note-p_memsz-overflow-during-header-update-v3 Signed-off-by: Greg Pearson <greg.pearson@xxxxxx> Acked-by: Vivek Goyal <vgoyal@xxxxxxxxxx> Cc: HATAYAMA Daisuke <d.hatayama@xxxxxxxxxxxxxx> Cc: Michael Holzheu <holzheu@xxxxxxxxxxxxxxxxxx> Cc: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/proc/vmcore.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff -puN fs/proc/vmcore.c~vmcore-prevent-pt_note-p_memsz-overflow-during-header-update-v3 fs/proc/vmcore.c --- a/fs/proc/vmcore.c~vmcore-prevent-pt_note-p_memsz-overflow-during-header-update-v3 +++ a/fs/proc/vmcore.c @@ -473,7 +473,8 @@ static int __init update_note_header_siz ((nhdr_ptr->n_namesz + 3) & ~3) + ((nhdr_ptr->n_descsz + 3) & ~3); if ((real_sz + sz) > max_sz) { - pr_warn("Warning: dropping PT_NOTE entry\n"); + pr_warn("Warning: Exceeded p_memsz, dropping PT_NOTE entry n_namesz=0x%x, n_descsz=0x%x\n", + nhdr_ptr->n_namesz, nhdr_ptr->n_descsz); break; } real_sz += sz; @@ -481,6 +482,10 @@ static int __init update_note_header_siz } kfree(notes_section); phdr_ptr->p_memsz = real_sz; + if (real_sz == 0) { + pr_warn("Warning: Zero PT_NOTE entries found\n"); + return -EINVAL; + } } return 0; @@ -655,7 +660,8 @@ static int __init update_note_header_siz ((nhdr_ptr->n_namesz + 3) & ~3) + ((nhdr_ptr->n_descsz + 3) & ~3); if ((real_sz + sz) > max_sz) { - pr_warn("Warning: dropping PT_NOTE entry\n"); + pr_warn("Warning: Exceeded p_memsz, dropping PT_NOTE entry n_namesz=0x%x, n_descsz=0x%x\n", + nhdr_ptr->n_namesz, nhdr_ptr->n_descsz); break; } real_sz += sz; @@ -663,6 +669,10 @@ static int __init update_note_header_siz } kfree(notes_section); phdr_ptr->p_memsz = real_sz; + if (real_sz == 0) { + pr_warn("Warning: Zero PT_NOTE entries found\n"); + return -EINVAL; + } } return 0; _ Patches currently in -mm which might be from greg.pearson@xxxxxx are vmcore-prevent-pt_note-p_memsz-overflow-during-header-update.patch vmcore-prevent-pt_note-p_memsz-overflow-during-header-update-v2.patch vmcore-prevent-pt_note-p_memsz-overflow-during-header-update-v3.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html