On Fri, Jun 10, 2011 at 4:12 PM, Greg KH <[email protected]> wrote: > On Fri, Jun 10, 2011 at 10:16:18AM +0200, Mathias Krause wrote: >> Hi Greg, >> >> On Fri, Jun 10, 2011 at 12:37 AM, <[email protected]> wrote: >> > This is a note to let you know that I've just added the patch titled >> > >> > exec: delay address limit change until point of no return >> > >> > to the 2.6.39-stable tree which can be found at: >> > >> > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary >> > >> > The filename of the patch is: >> > exec-delay-address-limit-change-until-point-of-no-return.patch >> > and it can be found in the queue-2.6.39 subdirectory. >> >> could this patch please be added to the longterm kernel 2.6.32, too? > > Sure, can you provide a backport for 2.6.32? As it is, it didn't apply.
See below. Successfully tested on i386 and x86-64. Mathias -- >8 -- Subject: [PATCH] exec: delay address limit change until point of no return Unconditionally changing the address limit to USER_DS and not restoring it to its old value in the error path is wrong because it prevents us using kernel memory on repeated calls to this function. This, in fact, breaks the fallback of hard coded paths to the init program from being ever successful if the first candidate fails to load. With this patch applied switching to USER_DS is delayed until the point of no return is reached which makes it possible to have a multi-arch rootfs with one arch specific init binary for each of the (hard coded) probed paths. Since the address limit is already set to USER_DS when start_thread() will be invoked, this redundancy can be safely removed. Signed-off-by: Mathias Krause <[email protected]> Cc: Al Viro <[email protected]> Cc: [email protected] Signed-off-by: Linus Torvalds <[email protected]> --- This is a backport of the original commit (dac853a: exec: delay address limit...) to the v2.6.32 longterm series. arch/x86/kernel/process_32.c | 1 - arch/x86/kernel/process_64.c | 1 - fs/exec.c | 5 +---- 3 files changed, 1 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c index 4cf7956..c40c432 100644 --- a/arch/x86/kernel/process_32.c +++ b/arch/x86/kernel/process_32.c @@ -298,7 +298,6 @@ start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp) { set_user_gs(regs, 0); regs->fs = 0; - set_fs(USER_DS); regs->ds = __USER_DS; regs->es = __USER_DS; regs->ss = __USER_DS; diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c index 868fdb4..39493bc 100644 --- a/arch/x86/kernel/process_64.c +++ b/arch/x86/kernel/process_64.c @@ -356,7 +356,6 @@ start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp) regs->cs = __USER_CS; regs->ss = __USER_DS; regs->flags = 0x200; - set_fs(USER_DS); /* * Free the old FP and other extended state */ diff --git a/fs/exec.c b/fs/exec.c index 0cf881d..86fafc6 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1009,6 +1009,7 @@ int flush_old_exec(struct linux_binprm * bprm) bprm->mm = NULL; /* We're using it now */ + set_fs(USER_DS); current->flags &= ~PF_RANDOMIZE; flush_thread(); current->personality &= ~bprm->per_clear; @@ -1276,10 +1277,6 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs) if (retval) return retval; - /* kernel module loader fixup */ - /* so we don't try to load run modprobe in kernel space. */ - set_fs(USER_DS); - retval = audit_bprm(bprm); if (retval) return retval; -- 1.5.6.5 _______________________________________________ stable mailing list [email protected] http://linux.kernel.org/mailman/listinfo/stable
