Re: [BUG] binfmt_elf: get_user() called in vma_dump_size() after set_fs(KERNEL_DS)

[Roland McGrath <roland@redhat.com>]

> Yes, I suspect just surrounding the load with set_fs(USER_DS) and then 
> set_fs(KERNEL_DS) to put it back is likely the right thing to do.

Agreed.

> The address is "safe" in that it does come from the vma, but we obviously 
> do play games with things like the call gate mappings etc. 

gate_vma has VM_ALWAYSDUMP so it never sees this whole path anyway.
I doubt there is any actual case.  But, point taken.

> Should we also perhaps do this only if the vma is marked readable and
> executable? That way we could avoid taking unnecessary faults there.
> 
> Probably doesn't really matter. 

I'm sure it doesn't really matter.  But, just to say it all: Requiring
VM_EXEC would actually exclude some valid cases.  Even requiring VM_READ is
less than perfect as far as pedantic semantics go--but there is no reason
not to check it since its lack rules out get_user() actually working
anyway.  I already chose that trade-off since get_user() here is so much
cheaper than get_user_pages().  The core dump from a stray
"mprotect(0,1UL<<32,PROT_NONE)" (i.e. presumably actually one with some
arithmetic error) would be useful if we made the check work without
VM_READ, but oh well.


Thanks,
Roland