@@ -967,9 +967,17 @@ static int load_elf_binary(struct linux_binprm *bprm)
if (current->flags & PF_RANDOMIZE)
load_bias += arch_mmap_rnd();
elf_flags |= MAP_FIXED;
- } else
+ } else {
load_bias = 0;
+ total_size = total_mapping_size(elf_phdata,
+ loc->elf_ex.e_phnum);
+ if (!total_size) {
+ retval = -EINVAL;
+ goto out_free_dentry;
+ }
+ }
+
/*
* Since load_bias is used for all subsequent loading
* calculations, we must lower it by the first vaddr
@@ -978,13 +986,6 @@ static int load_elf_binary(struct linux_binprm *bprm)
* is then page aligned.
*/
load_bias = ELF_PAGESTART(load_bias - vaddr);
-
- total_size = total_mapping_size(elf_phdata,
- loc->elf_ex.e_phnum);
- if (!total_size) {
- retval = -EINVAL;
- goto out_free_dentry;
- }
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
In commit: eab09532d4 ("binfmt_elf: use ELF_ET_DYN_BASE only for PIE") ... PIE programs are loaded offset from ELF_ET_DYN_BASE, and its map has been set as MAP_FIXED. Only dynamic loader will be mapped from below mm->mmap_base (E.g "./ld.so someprog"), and need take account of the need to allocate sufficient space for the entire loader image to avoid the case that the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the area that is supposed to be the "gap" between the stack and mm->mmap_base. Whether it's harmless or not, we should not allow program to map above mm->mmap_base. So here change to get the total_size only for dynamic loader in load_elf_binary(). Signed-off-by: Baoquan He <bhe@redhat.com> --- fs/binfmt_elf.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)