coredump: Also dump first pages of non-executable ELF libraries
authorJann Horn <jannh@google.com>
Wed, 26 Jan 2022 02:57:39 +0000 (03:57 +0100)
committerKees Cook <keescook@chromium.org>
Wed, 2 Mar 2022 00:16:26 +0000 (16:16 -0800)
commit84158b7f6a0624b81800b4e7c90f7fb7fdecf66c
tree92420ed5ec7ee5ab9a87e97bd13fe4e07d3e0561
parent10b19249192ae28ee9092ceca327a83d27d88bd0
coredump: Also dump first pages of non-executable ELF libraries

When I rewrote the VMA dumping logic for coredumps, I changed it to
recognize ELF library mappings based on the file being executable instead
of the mapping having an ELF header. But turns out, distros ship many ELF
libraries as non-executable, so the heuristic goes wrong...

Restore the old behavior where FILTER(ELF_HEADERS) dumps the first page of
any offset-0 readable mapping that starts with the ELF magic.

This fix is technically layer-breaking a bit, because it checks for
something ELF-specific in fs/coredump.c; but since we probably want to
share this between standard ELF and FDPIC ELF anyway, I guess it's fine?
And this also keeps the change small for backporting.

Cc: stable@vger.kernel.org
Fixes: 429a22e776a2 ("coredump: rework elf/elf_fdpic vma_dump_size() into common helper")
Reported-by: Bill Messmer <wmessmer@microsoft.com>
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220126025739.2014888-1-jannh@google.com
fs/coredump.c