Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
View | Details | Raw Unified | Return to bug 86783
Collapse All | Expand All

(-)25/fs/binfmt_elf.c~load_elf_binary-kfree-fix (-13 / +17 lines)
Lines 1028-1033 out_free_ph: Link Here
1028
static int load_elf_library(struct file *file)
1028
static int load_elf_library(struct file *file)
1029
{
1029
{
1030
	struct elf_phdr *elf_phdata;
1030
	struct elf_phdr *elf_phdata;
1031
	struct elf_phdr *eppnt;
1031
	unsigned long elf_bss, bss, len;
1032
	unsigned long elf_bss, bss, len;
1032
	int retval, error, i, j;
1033
	int retval, error, i, j;
1033
	struct elfhdr elf_ex;
1034
	struct elfhdr elf_ex;
Lines 1051-1094 static int load_elf_library(struct file Link Here
1051
	/* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1052
	/* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1052
1053
1053
	error = -ENOMEM;
1054
	error = -ENOMEM;
1054
	elf_phdata = (struct elf_phdr *) kmalloc(j, GFP_KERNEL);
1055
	elf_phdata = kmalloc(j, GFP_KERNEL);
1055
	if (!elf_phdata)
1056
	if (!elf_phdata)
1056
		goto out;
1057
		goto out;
1057
1058
1059
	eppnt = elf_phdata;
1058
	error = -ENOEXEC;
1060
	error = -ENOEXEC;
1059
	retval = kernel_read(file, elf_ex.e_phoff, (char *) elf_phdata, j);
1061
	retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1060
	if (retval != j)
1062
	if (retval != j)
1061
		goto out_free_ph;
1063
		goto out_free_ph;
1062
1064
1063
	for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1065
	for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1064
		if ((elf_phdata + i)->p_type == PT_LOAD) j++;
1066
		if ((eppnt + i)->p_type == PT_LOAD)
1067
			j++;
1065
	if (j != 1)
1068
	if (j != 1)
1066
		goto out_free_ph;
1069
		goto out_free_ph;
1067
1070
1068
	while (elf_phdata->p_type != PT_LOAD) elf_phdata++;
1071
	while (eppnt->p_type != PT_LOAD)
1072
		eppnt++;
1069
1073
1070
	/* Now use mmap to map the library into memory. */
1074
	/* Now use mmap to map the library into memory. */
1071
	down_write(&current->mm->mmap_sem);
1075
	down_write(&current->mm->mmap_sem);
1072
	error = do_mmap(file,
1076
	error = do_mmap(file,
1073
			ELF_PAGESTART(elf_phdata->p_vaddr),
1077
			ELF_PAGESTART(eppnt->p_vaddr),
1074
			(elf_phdata->p_filesz +
1078
			(eppnt->p_filesz +
1075
			 ELF_PAGEOFFSET(elf_phdata->p_vaddr)),
1079
			 ELF_PAGEOFFSET(eppnt->p_vaddr)),
1076
			PROT_READ | PROT_WRITE | PROT_EXEC,
1080
			PROT_READ | PROT_WRITE | PROT_EXEC,
1077
			MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1081
			MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1078
			(elf_phdata->p_offset -
1082
			(eppnt->p_offset -
1079
			 ELF_PAGEOFFSET(elf_phdata->p_vaddr)));
1083
			 ELF_PAGEOFFSET(eppnt->p_vaddr)));
1080
	up_write(&current->mm->mmap_sem);
1084
	up_write(&current->mm->mmap_sem);
1081
	if (error != ELF_PAGESTART(elf_phdata->p_vaddr))
1085
	if (error != ELF_PAGESTART(eppnt->p_vaddr))
1082
		goto out_free_ph;
1086
		goto out_free_ph;
1083
1087
1084
	elf_bss = elf_phdata->p_vaddr + elf_phdata->p_filesz;
1088
	elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1085
	if (padzero(elf_bss)) {
1089
	if (padzero(elf_bss)) {
1086
		error = -EFAULT;
1090
		error = -EFAULT;
1087
		goto out_free_ph;
1091
		goto out_free_ph;
1088
	}
1092
	}
1089
1093
1090
	len = ELF_PAGESTART(elf_phdata->p_filesz + elf_phdata->p_vaddr + ELF_MIN_ALIGN - 1);
1094
	len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + ELF_MIN_ALIGN - 1);
1091
	bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
1095
	bss = eppnt->p_memsz + eppnt->p_vaddr;
1092
	if (bss > len) {
1096
	if (bss > len) {
1093
		down_write(&current->mm->mmap_sem);
1097
		down_write(&current->mm->mmap_sem);
1094
		do_brk(len, bss - len);
1098
		do_brk(len, bss - len);

Return to bug 86783