2 files changed, 32 insertions, 24 deletions

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index c1a499599b7d..6fc49b6ed936 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1856,6 +1856,7 @@ static int elf_core_dump(struct coredump_params *cprm)
         loff_t offset = 0, dataoff, foffset;
         unsigned long mm_flags;
         struct elf_note_info info;
+        struct elf_phdr *phdr4note = NULL;
 
         /*
          * We no longer stop all VM operations.
@@ -1898,28 +1899,22 @@ static int elf_core_dump(struct coredump_params *cprm)
         fs = get_fs();
         set_fs(KERNEL_DS);
 
-        size += sizeof(*elf);
-        if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
-                goto end_coredump;
-
         offset += sizeof(*elf);                         /* Elf header */
         offset += (segs + 1) * sizeof(struct elf_phdr); /* Program headers */
         foffset = offset;
 
         /* Write notes phdr entry */
         {
-                struct elf_phdr phdr;
                 size_t sz = get_note_info_size(&info);
 
                 sz += elf_coredump_extra_notes_size();
 
-                fill_elf_note_phdr(&phdr, sz, offset);
-                offset += sz;
-
-                size += sizeof(phdr);
-                if (size > cprm->limit
-                    || !dump_write(cprm->file, &phdr, sizeof(phdr)))
+                phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
+                if (!phdr4note)
                         goto end_coredump;
+
+                fill_elf_note_phdr(phdr4note, sz, offset);
+                offset += sz;
         }
 
         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
@@ -1931,6 +1926,15 @@ static int elf_core_dump(struct coredump_params *cprm)
          */
         mm_flags = current->mm->flags;
 
+        size += sizeof(*elf);
+        if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
+                goto end_coredump;
+
+        size += sizeof(*phdr4note);
+        if (size > cprm->limit
+            || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
+                goto end_coredump;
+
         /* Write program headers for segments dump */
         for (vma = first_vma(current, gate_vma); vma != NULL;
                         vma = next_vma(vma, gate_vma)) {
@@ -2004,6 +2008,7 @@ end_coredump:
 
 cleanup:
         free_note_info(&info);
+        kfree(phdr4note);
         kfree(elf);
 out:
         return has_dumped;
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 952699a86ec3..112da491d75d 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -1600,6 +1600,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
         int thread_status_size = 0;
         elf_addr_t *auxv;
         unsigned long mm_flags;
+        struct elf_phdr *phdr4note = NULL;
 
         /*
          * We no longer stop all VM operations.
@@ -1706,18 +1707,12 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
         fs = get_fs();
         set_fs(KERNEL_DS);
 
-        size += sizeof(*elf);
-        if (size > cprm->limit
-            || !dump_write(cprm->file, elf, sizeof(*elf)))
-                goto end_coredump;
-
         offset += sizeof(*elf);                         /* Elf header */
         offset += (segs+1) * sizeof(struct elf_phdr);   /* Program headers */
         foffset = offset;
 
         /* Write notes phdr entry */
         {
-                struct elf_phdr phdr;
                 int sz = 0;
 
                 for (i = 0; i < numnote; i++)
@@ -1725,13 +1720,12 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
 
                 sz += thread_status_size;
 
-                fill_elf_note_phdr(&phdr, sz, offset);
-                offset += sz;
-
-                size += sizeof(phdr);
-                if (size > cprm->limit
-                    || !dump_write(cprm->file, &phdr, sizeof(phdr)))
+                phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
+                if (!phdr4note)
                         goto end_coredump;
+
+                fill_elf_note_phdr(phdr4note, sz, offset);
+                offset += sz;
         }
 
         /* Page-align dumped data */
@@ -1744,6 +1738,15 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
          */
         mm_flags = current->mm->flags;
 
+        size += sizeof(*elf);
+        if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
+                goto end_coredump;
+
+        size += sizeof(*phdr4note);
+        if (size > cprm->limit
+            || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
+                goto end_coredump;
+
         /* write program headers for segments dump */
         for (vma = current->mm->mmap; vma; vma = vma->vm_next) {
                 struct elf_phdr phdr;
@@ -1815,7 +1818,7 @@ cleanup:
                 list_del(tmp);
                 kfree(list_entry(tmp, struct elf_thread_status, list));
         }
-
+        kfree(phdr4note);
         kfree(elf);
         kfree(prstatus);
         kfree(psinfo);