Commit dc02747d authored by Matthew Wilcox's avatar Matthew Wilcox Committed by Matthew Wilcox

[PARISC] Fix fs/binfmt_som.c

Fix compilation (missing include of a.out.h)
Fix security hole (need to call unshare_files)
Signed-off-by: default avatarMatthew Wilcox <matthew@wil.cx>
Signed-off-by: default avatarKyle McMartin <kyle@parisc-linux.org>
parent 8d0b7d10
...@@ -29,6 +29,7 @@ ...@@ -29,6 +29,7 @@
#include <linux/personality.h> #include <linux/personality.h>
#include <linux/init.h> #include <linux/init.h>
#include <asm/a.out.h>
#include <asm/uaccess.h> #include <asm/uaccess.h>
#include <asm/pgtable.h> #include <asm/pgtable.h>
...@@ -194,6 +195,7 @@ load_som_binary(struct linux_binprm * bprm, struct pt_regs * regs) ...@@ -194,6 +195,7 @@ load_som_binary(struct linux_binprm * bprm, struct pt_regs * regs)
unsigned long som_entry; unsigned long som_entry;
struct som_hdr *som_ex; struct som_hdr *som_ex;
struct som_exec_auxhdr *hpuxhdr; struct som_exec_auxhdr *hpuxhdr;
struct files_struct *files;
/* Get the exec-header */ /* Get the exec-header */
som_ex = (struct som_hdr *) bprm->buf; som_ex = (struct som_hdr *) bprm->buf;
...@@ -208,15 +210,27 @@ load_som_binary(struct linux_binprm * bprm, struct pt_regs * regs) ...@@ -208,15 +210,27 @@ load_som_binary(struct linux_binprm * bprm, struct pt_regs * regs)
size = som_ex->aux_header_size; size = som_ex->aux_header_size;
if (size > SOM_PAGESIZE) if (size > SOM_PAGESIZE)
goto out; goto out;
hpuxhdr = (struct som_exec_auxhdr *) kmalloc(size, GFP_KERNEL); hpuxhdr = kmalloc(size, GFP_KERNEL);
if (!hpuxhdr) if (!hpuxhdr)
goto out; goto out;
retval = kernel_read(bprm->file, som_ex->aux_header_location, retval = kernel_read(bprm->file, som_ex->aux_header_location,
(char *) hpuxhdr, size); (char *) hpuxhdr, size);
if (retval != size) {
if (retval >= 0)
retval = -EIO;
goto out_free;
}
files = current->files; /* Refcounted so ok */
retval = unshare_files();
if (retval < 0) if (retval < 0)
goto out_free; goto out_free;
#error "Fix security hole before enabling me" if (files == current->files) {
put_files_struct(files);
files = NULL;
}
retval = get_unused_fd(); retval = get_unused_fd();
if (retval < 0) if (retval < 0)
goto out_free; goto out_free;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment