ELF: fix overflow in total mapping size calculation
authorAlexey Dobriyan <adobriyan@gmail.com>
Thu, 30 Dec 2021 09:29:12 +0000 (20:29 +1100)
committerStephen Rothwell <sfr@canb.auug.org.au>
Sun, 16 Jan 2022 07:39:37 +0000 (18:39 +1100)
commit21da7c8efbcb9751562bb7f9d19a82b2b0a424c6
tree5c8df1def39479b5a08f1137041f1d47e6063d98
parent1e9b0232df92792533ee8a48107b3bf10f2a115e
ELF: fix overflow in total mapping size calculation

Kernel assumes that ELF program headers are ordered by mapping address,
but doesn't enforce it.  It is possible to make mapping size extremely
huge by simply shuffling first and last PT_LOAD segments.

As long as PT_LOAD segments do not overlap, it is silly to require sorting
by v_addr anyway because mmap() doesn't care.

Don't assume PT_LOAD segments are sorted and calculate min and max
addresses correctly.

Link: https://lkml.kernel.org/r/YVmd7D0M6G/DcP4O@localhost.localdomain
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
fs/binfmt_elf.c