Re: 2.2.0 SECURITY

David S. Miller (davem@dm.cobaltmicro.com)
Wed, 27 Jan 1999 00:16:39 -0800


Date: Wed, 27 Jan 1999 00:11:22 -0800 (PST)
From: Jeremy Fitzhardinge <jeremy@goop.org>

"stuff"? Like corrupting the coredump? Doesn't seem to be the height of
problems. I think at worst you could corrupt the content of the file, but
you can't make it start writing to the wrong place.

I'm just being anal here... you're probably right.

I think you've misread the macro stuff, ugly though it is. There's two
definitions of DUMP_SEEK and DUMP_WRITE. The first returns, but its used in a
context where that's OK. The second does a goto close_coredump on error, which
does the write thing with regard to segments and other cleanup.

Sorry, missed the redefines, my bad.

Its clearly not the coredump code which is causing problems though - it looks
like exec of a core file is the problem, or whatever ldd does. The core files
are being generated fine.

What it should be doing is:

1) Exec'ing /lib/ld-linux.so.2
2) That reads in the ELF header of the core file
3) Next it mmap's all of the segments
4) Next it jumps into lala-land in on of the final mmaps
is got, and dies with an illegal instruction on Sparc

I think something hokey is happening at step #4 on Intel if the timing
is right as the process is being killed...

Later,
David S. Miller
davem@dm.cobaltmicro.com

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/