[POWERPC] 4xx: Add AMCC Makalu board support to platforms/40x

[pandora-kernel.git] / fs / binfmt_aout.c

diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index f312103..7596e1e 100644 (file)
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -31,7 +31,7 @@
 
 static int load_aout_binary(struct linux_binprm *, struct pt_regs * regs);
 static int load_aout_library(struct file*);
-static int aout_core_dump(long signr, struct pt_regs * regs, struct file *file);
+static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
 
 static struct linux_binfmt aout_format = {
        .module         = THIS_MODULE,
@@ -88,7 +88,7 @@ if (file->f_op->llseek) { \
  * dumping of the process results in another error..
  */
 
-static int aout_core_dump(long signr, struct pt_regs * regs, struct file *file)
+static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file, unsigned long limit)
 {
        mm_segment_t fs;
        int has_dumped = 0;
@@ -123,23 +123,19 @@ static int aout_core_dump(long signr, struct pt_regs * regs, struct file *file)
 /* If the size of the dump file exceeds the rlimit, then see what would happen
    if we wrote the stack, but not the data area.  */
 #ifdef __sparc__
-       if ((dump.u_dsize+dump.u_ssize) >
-           current->signal->rlim[RLIMIT_CORE].rlim_cur)
+       if ((dump.u_dsize + dump.u_ssize) > limit)
                dump.u_dsize = 0;
 #else
-       if ((dump.u_dsize+dump.u_ssize+1) * PAGE_SIZE >
-           current->signal->rlim[RLIMIT_CORE].rlim_cur)
+       if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
                dump.u_dsize = 0;
 #endif
 
 /* Make sure we have enough room to write the stack and data areas. */
 #ifdef __sparc__
-       if ((dump.u_ssize) >
-           current->signal->rlim[RLIMIT_CORE].rlim_cur)
+       if (dump.u_ssize > limit)
                dump.u_ssize = 0;
 #else
-       if ((dump.u_ssize+1) * PAGE_SIZE >
-           current->signal->rlim[RLIMIT_CORE].rlim_cur)
+       if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
                dump.u_ssize = 0;
 #endif
 
@@ -274,10 +270,17 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
        if ((N_MAGIC(ex) != ZMAGIC && N_MAGIC(ex) != OMAGIC &&
             N_MAGIC(ex) != QMAGIC && N_MAGIC(ex) != NMAGIC) ||
            N_TRSIZE(ex) || N_DRSIZE(ex) ||
-           i_size_read(bprm->file->f_dentry->d_inode) < ex.a_text+ex.a_data+N_SYMSIZE(ex)+N_TXTOFF(ex)) {
+           i_size_read(bprm->file->f_path.dentry->d_inode) < ex.a_text+ex.a_data+N_SYMSIZE(ex)+N_TXTOFF(ex)) {
                return -ENOEXEC;
        }
 
+       /*
+        * Requires a mmap handler. This prevents people from using a.out
+        * as part of an exploit attack against /proc-related vulnerabilities.
+        */
+       if (!bprm->file->f_op || !bprm->file->f_op->mmap)
+               return -ENOEXEC;
+
        fd_offset = N_TXTOFF(ex);
 
        /* Check initial limits. This avoids letting people circumvent
@@ -316,7 +319,6 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
        current->mm->free_area_cache = current->mm->mmap_base;
        current->mm->cached_hole_size = 0;
 
-       current->mm->mmap = NULL;
        compute_creds(bprm);
        current->flags &= ~PF_FORKNOEXEC;
 #ifdef __sparc__
@@ -382,7 +384,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
                {
                        printk(KERN_WARNING 
                               "fd_offset is not page aligned. Please convert program: %s\n",
-                              bprm->file->f_dentry->d_name.name);
+                              bprm->file->f_path.dentry->d_name.name);
                        error_time = jiffies;
                }
 
@@ -462,7 +464,7 @@ static int load_aout_library(struct file *file)
        int retval;
        struct exec ex;
 
-       inode = file->f_dentry->d_inode;
+       inode = file->f_path.dentry->d_inode;
 
        retval = -ENOEXEC;
        error = kernel_read(file, 0, (char *) &ex, sizeof(ex));
@@ -476,6 +478,13 @@ static int load_aout_library(struct file *file)
                goto out;
        }
 
+       /*
+        * Requires a mmap handler. This prevents people from using a.out
+        * as part of an exploit attack against /proc-related vulnerabilities.
+        */
+       if (!file->f_op || !file->f_op->mmap)
+               goto out;
+
        if (N_FLAGS(ex))
                goto out;
 
@@ -492,7 +501,7 @@ static int load_aout_library(struct file *file)
                {
                        printk(KERN_WARNING 
                               "N_TXTOFF is not page aligned. Please convert library: %s\n",
-                              file->f_dentry->d_name.name);
+                              file->f_path.dentry->d_name.name);
                        error_time = jiffies;
                }
                down_write(&current->mm->mmap_sem);