The commit is pushed to "branch-rh9-5.14.0-427.44.1.vz9.80.x-ovz" and will
appear at g...@bitbucket.org:openvz/vzkernel.git
after rh9-5.14.0-427.44.1.vz9.80.5
------>
commit 71b53cb8f26d180c801aa5f4bbfd4dc67b26a379
Author: Anthony Yznaga <anthony.yzn...@oracle.com>
Date: Fri Mar 25 17:19:16 2022 -0700
oracle/exec, elf: ignore invalid note data
When checking for a preserved-mem-ok note in a PT_NOTE segment, the
implementation assumes that note data is accessible through the note
segment and that the size of the PT_NOTE must be equal to the total size
of ELF notes headers+data. Normally ELF notes are in contiguous SHT_NOTE
sections and the PT_NOTE segment points to the first note. However, in a
third-party binary affected by this bug the PT_NOTE segment size is the
correct total size of the notes, but the segment offset is different and
points to all zeros. The note checking implementation fails the exec
because it incorrectly determines the total size to be invalid due to
reading all zeros.
The fix is to ignore data that does not appear to be a note and to not
make assumptions about the total size of the note segment that are
dependent on other notes. Failing the exec is then limited to validity
checks of the preserved-mem-ok note itself.
Orabug: 34003079
mFixes: d1a6a6483fff ("exec, elf: require opt-in for accepting preserved
mem")
Signed-off-by: Anthony Yznaga <anthony.yzn...@oracle.com>
Reviewed-by: John Donnelly <john.p.donne...@oracle.com>
https://virtuozzo.atlassian.net/browse/VSTOR-96305
(cherry picked from Oracle commit bdc9618f44e81bf422782c01cfb2ac9da01a4b56)
Signed-off-by: Konstantin Khorenko <khore...@virtuozzo.com>
Feature: oracle/mm: MADV_DOEXEC madvise() flag
---
fs/binfmt_elf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 9fe7f4cd5f6e..948d1a547133 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -869,7 +869,7 @@ static int check_preserved_mem_ok(struct linux_binprm
*bprm, const char *data, c
remain = datasz - off;
if (remain < sizeof(*nhdr))
- return -ENOEXEC;
+ break;
nhdr = (struct elf_note *)(data + off);
off += sizeof(*nhdr);
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
