ELF: fix overflow in total mapping size calculation
authorAlexey Dobriyan <adobriyan@gmail.com>
Wed, 16 Feb 2022 04:31:58 +0000 (15:31 +1100)
committerStephen Rothwell <sfr@canb.auug.org.au>
Thu, 17 Feb 2022 03:46:54 +0000 (14:46 +1100)
commit5fab2bc891e354cc34c0a6a87e598ef102dd34c3
tree733ca81beccfd57fa7603108a077233a5859ddca
parent424807d5b4b901342ac37c80e057ef9e5475f002
ELF: fix overflow in total mapping size calculation

Kernel assumes that ELF program headers are ordered by mapping address,
but doesn't enforce it.  It is possible to make mapping size extremely
huge by simply shuffling first and last PT_LOAD segments.

As long as PT_LOAD segments do not overlap, it is silly to require sorting
by v_addr anyway because mmap() doesn't care.

Don't assume PT_LOAD segments are sorted and calculate min and max
addresses correctly.

Link: https://lore.kernel.org/all/YVmd7D0M6G/DcP4O@localhost.localdomain/
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Tested-by: Magnus Groß <magnus.gross@rwth-aachen.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Eric Biederman <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
fs/binfmt_elf.c