View | Details | Raw Unified
Collapse All | Expand All

(-) 25/fs/binfmt_elf.c~load_elf_binary-kfree-fix (-13 / +17 lines)
 Lines 1028-1033   out_free_ph: Link Here  
static int load_elf_library(struct file *file)
static int load_elf_library(struct file *file)
{
{
	struct elf_phdr *elf_phdata;
	struct elf_phdr *elf_phdata;
	struct elf_phdr *eppnt;
 
	unsigned long elf_bss, bss, len;
	unsigned long elf_bss, bss, len;
	int retval, error, i, j;
	int retval, error, i, j;
	struct elfhdr elf_ex;
	struct elfhdr elf_ex;
 Lines 1051-1094   static int load_elf_library(struct file Link Here  
	/* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
	/* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */

        
	error = -ENOMEM;
	error = -ENOMEM;

            

              
	elf_phdata = (struct elf_phdr *) kmalloc(j, GFP_KERNEL);

              
	elf_phdata = kmalloc(j, GFP_KERNEL);

            

        
	if (!elf_phdata)
	if (!elf_phdata)

        
		goto out;
		goto out;

        

            

              
              
	eppnt = elf_phdata;

            

        
	error = -ENOEXEC;
	error = -ENOEXEC;

            

              
	retval = kernel_read(file, elf_ex.e_phoff, (char *) elf_phdata, j);

              
	retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);

            

        
	if (retval != j)
	if (retval != j)

        
		goto out_free_ph;
		goto out_free_ph;

        

        
	for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
	for (j = 0, i = 0; i<elf_ex.e_phnum; i++)

            

              
		if ((elf_phdata + i)->p_type == PT_LOAD) j++;

              
		if ((eppnt + i)->p_type == PT_LOAD)

            

            

              

              
			j++;

            

        
	if (j != 1)
	if (j != 1)

        
		goto out_free_ph;
		goto out_free_ph;

        

            

              
	while (elf_phdata->p_type != PT_LOAD) elf_phdata++;

              
	while (eppnt->p_type != PT_LOAD)

            

            

              

              
		eppnt++;

            

        

        
	/* Now use mmap to map the library into memory. */
	/* Now use mmap to map the library into memory. */

        
	down_write(&current->mm->mmap_sem);
	down_write(&current->mm->mmap_sem);

        
	error = do_mmap(file,
	error = do_mmap(file,

            

              
			ELF_PAGESTART(elf_phdata->p_vaddr),

              
			ELF_PAGESTART(eppnt->p_vaddr),

            

            

              
			(elf_phdata->p_filesz +

              
			(eppnt->p_filesz +

            

            

              
			 ELF_PAGEOFFSET(elf_phdata->p_vaddr)),

              
			 ELF_PAGEOFFSET(eppnt->p_vaddr)),

            

        
			PROT_READ | PROT_WRITE | PROT_EXEC,
			PROT_READ | PROT_WRITE | PROT_EXEC,

        
			MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
			MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,

            

              
			(elf_phdata->p_offset -

              
			(eppnt->p_offset -

            

            

              
			 ELF_PAGEOFFSET(elf_phdata->p_vaddr)));

              
			 ELF_PAGEOFFSET(eppnt->p_vaddr)));

            

        
	up_write(&current->mm->mmap_sem);
	up_write(&current->mm->mmap_sem);

            

              
	if (error != ELF_PAGESTART(elf_phdata->p_vaddr))

              
	if (error != ELF_PAGESTART(eppnt->p_vaddr))

            

        
		goto out_free_ph;
		goto out_free_ph;

        

            

              
	elf_bss = elf_phdata->p_vaddr + elf_phdata->p_filesz;

              
	elf_bss = eppnt->p_vaddr + eppnt->p_filesz;

            

        
	if (padzero(elf_bss)) {
	if (padzero(elf_bss)) {

        
		error = -EFAULT;
		error = -EFAULT;

        
		goto out_free_ph;
		goto out_free_ph;

        
	}
	}

        

            

              
	len = ELF_PAGESTART(elf_phdata->p_filesz + elf_phdata->p_vaddr + ELF_MIN_ALIGN - 1);

              
	len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + ELF_MIN_ALIGN - 1);

            

            

              
	bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;

              
	bss = eppnt->p_memsz + eppnt->p_vaddr;

            

        
	if (bss > len) {
	if (bss > len) {

        
		down_write(&current->mm->mmap_sem);
		down_write(&current->mm->mmap_sem);

        
		do_brk(len, bss - len);
		do_brk(len, bss - len);