coredump: Also dump first pages of non-executable ELF libraries
authorJann Horn <jannh@google.com>
Wed, 26 Jan 2022 02:57:39 +0000 (03:57 +0100)
committerKees Cook <keescook@chromium.org>
Tue, 1 Mar 2022 00:53:43 +0000 (16:53 -0800)
commite291a107b0a2aaea1c19c6c42b69310705886bf7
treeba483cf4d24ec72afd565f797a0575cb5b9eca1a
parentd49fd967f4cc5a27f63cd5f7d1c100c6359f9b4c
coredump: Also dump first pages of non-executable ELF libraries

When I rewrote the VMA dumping logic for coredumps, I changed it to
recognize ELF library mappings based on the file being executable instead
of the mapping having an ELF header. But turns out, distros ship many ELF
libraries as non-executable, so the heuristic goes wrong...

Restore the old behavior where FILTER(ELF_HEADERS) dumps the first page of
any offset-0 readable mapping that starts with the ELF magic.

This fix is technically layer-breaking a bit, because it checks for
something ELF-specific in fs/coredump.c; but since we probably want to
share this between standard ELF and FDPIC ELF anyway, I guess it's fine?
And this also keeps the change small for backporting.

Cc: stable@vger.kernel.org
Fixes: 429a22e776a2 ("coredump: rework elf/elf_fdpic vma_dump_size() into common helper")
Reported-by: Bill Messmer <wmessmer@microsoft.com>
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220126025739.2014888-1-jannh@google.com
fs/coredump.c