diff options
| author | Alexey Dobriyan <adobriyan@gmail.com> | 2021-10-03 15:11:24 +0300 |
|---|---|---|
| committer | Kees Cook <keescook@chromium.org> | 2022-03-01 16:16:26 -0800 |
| commit | 10b19249192ae28ee9092ceca327a83d27d88bd0 (patch) | |
| tree | 9746e4f7261714746718487925128b6fe0e88dc9 /fs/coredump.c | |
| parent | 439a8468242b313486e69b8cc3b45ddcfa898fbf (diff) | |
ELF: fix overflow in total mapping size calculation
Kernel assumes that ELF program headers are ordered by mapping address,
but doesn't enforce it. It is possible to make mapping size extremely huge
by simply shuffling first and last PT_LOAD segments.
As long as PT_LOAD segments do not overlap, it is silly to require
sorting by v_addr anyway because mmap() doesn't care.
Don't assume PT_LOAD segments are sorted and calculate min and max
addresses correctly.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Tested-by: "Magnus Groß" <magnus.gross@rwth-aachen.de>
Link: https://lore.kernel.org/all/Yfqm7HbucDjPbES+@fractal.localdomain/
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/lkml/YVmd7D0M6G%2FDcP4O@localhost.localdomain
Diffstat (limited to 'fs/coredump.c')
0 files changed, 0 insertions, 0 deletions