[VZ8,1/5] prctl: Fix false positive in validate_prctl_map

Submitted by Pavel Tikhomirov on March 10, 2020, 10:31 a.m.

Details

Message ID 20200310103150.214003-2-ptikhomirov@virtuozzo.com
State New
Series "fixes to VZ8 required for criu"
Headers show

Commit Message

Pavel Tikhomirov March 10, 2020, 10:31 a.m.
From: Kirill Gorkunov <gorcunov@virtuozzo.com>

While validating new map we require the @start_data to be strictly less
than @end_data, which is fine for regular applications (this is why this
nit didn't trigger for that long). These members are set from executable
loaders such as elf halders, still it is pretty valid to have a loadable
data section with zero size in file, in such case the start_data is equal
to end_data once kernel loader finishes.

In result when we'are trying to restore such program the procedure fails
and kernel returns -EINVAL. From the image dump of a program:

 | "mm_start_code": "0x400000",
 | "mm_end_code": "0x8f5fb4",
 | "mm_start_data": "0xf1bfb0",
 | "mm_end_data": "0xf1bfb0",

Thus we need to change validate_prctl_map from strictly less to less or
equal operator use.

https://jira.sw.ru/browse/PSBM-93526

mFixes: f606b77f1a9e362451aca8f81d8f36a3a112139e
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>

ms commit a9e73998f9d7 ("kernel/sys.c: prctl: fix false positive in
validate_prctl_map()")

https://jira.sw.ru/browse/PSBM-101289

Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
---
 kernel/sys.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch hide | download patch | download mbox

diff --git a/kernel/sys.c b/kernel/sys.c
index 20894e3332a9..2ff3db4f6543 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1953,7 +1953,7 @@  static int validate_prctl_map(struct prctl_mm_map *prctl_map)
 	((unsigned long)prctl_map->__m1 __op				\
 	 (unsigned long)prctl_map->__m2) ? 0 : -EINVAL
 	error  = __prctl_check_order(start_code, <, end_code);
-	error |= __prctl_check_order(start_data, <, end_data);
+	error |= __prctl_check_order(start_data,<=, end_data);
 	error |= __prctl_check_order(start_brk, <=, brk);
 	error |= __prctl_check_order(arg_start, <=, arg_end);
 	error |= __prctl_check_order(env_start, <=, env_end);