diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index 1651afc8656a97a29236ac40bf72c968aa9ebf63..240448b31b754a667a3ed244ce225728212c4f01 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -1035,7 +1035,24 @@ static int load_elf_binary(struct linux_binprm *bprm) unsigned long alignment; if (elf_ppnt->p_type == PT_OHOS_RANDOMDATA) { - get_random_bytes((void *)(elf_ppnt->p_vaddr + load_bias), (int)elf_ppnt->p_memsz); + if (elf_ppnt->p_memsz > PT_OHOS_RANDOMDATA_SIZE_LIMIT) { + retval = -EINVAL; + goto out_free_dentry; + } + + void *temp_buf = kmalloc(elf_ppnt->p_memsz, GFP_KERNEL); + if (!temp_buf) { + retval = -ENOMEM; + goto out_free_dentry; + } + + get_random_bytes(temp_buf, (int)elf_ppnt->p_memsz); + if (copy_to_user((void *)(elf_ppnt->p_vaddr + load_bias), temp_buf, (unsigned long)elf_ppnt->p_memsz)) { + retval = -EFAULT; + kfree(temp_buf); + goto out_free_dentry; + } + kfree(temp_buf); continue; } diff --git a/include/uapi/linux/elf.h b/include/uapi/linux/elf.h index 2f06a1195fee0064a5786aee8089f5dc060a6e63..2ae08e605c3c7fc20a15d23d45f5521decf1e94f 100644 --- a/include/uapi/linux/elf.h +++ b/include/uapi/linux/elf.h @@ -39,6 +39,7 @@ typedef __s64 Elf64_Sxword; #define PT_GNU_PROPERTY 0x6474e553 #define PT_OHOS_RANDOMDATA 0x6788fc60 /* ohos-specific segment */ +#define PT_OHOS_RANDOMDATA_SIZE_LIMIT 1024 * 128 #define PT_GNU_STACK (PT_LOOS + 0x474e551)