func: static int CVE_2010_0307_VULN_load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) char * elf_interpreter = NULL ; struct elf_phdr * elf_ppnt , * elf_phdata ; int retval , i ; unsigned int size ; struct { struct elfhdr elf_ex ; struct elfhdr interp_elf_ex ; } * loc ; loc = kmalloc ( sizeof ( * loc ) , GFP_KERNEL ); if ( ! loc )  loc -> elf_ex = * ( ( struct elfhdr * ) bprm -> buf ); retval = - ENOEXEC; if ( memcmp ( loc -> elf_ex . e_ident , ELFMAG , SELFMAG ) != 0 )  if ( loc -> elf_ex . e_type != ET_EXEC && loc -> elf_ex . e_type != ET_DYN )  if ( ! elf_check_arch ( & loc -> elf_ex ) )  if ( ! bprm -> file -> f_op || ! bprm -> file -> f_op -> mmap )  if ( loc -> elf_ex . e_phentsize != sizeof ( struct elf_phdr ) )  if ( loc -> elf_ex . e_phnum < 1 || loc -> elf_ex . e_phnum > 65536U / sizeof ( struct elf_phdr ) )  size = loc -> elf_ex . e_phnum * sizeof ( struct elf_phdr ); retval = - ENOMEM; elf_phdata = kmalloc ( size , GFP_KERNEL ); if ( ! elf_phdata )  retval = kernel_read ( bprm -> file , loc -> elf_ex . e_phoff , ( char * ) elf_phdata , size ); if ( retval != size )  elf_ppnt = elf_phdata; for (i = 0; i < loc->elf_ex.e_phnum; i++) if ( elf_ppnt -> p_type == PT_INTERP )  if ( elf_ppnt -> p_filesz > PATH_MAX || elf_ppnt -> p_filesz < 2 )  retval = - ENOMEM; elf_interpreter = kmalloc ( elf_ppnt -> p_filesz , GFP_KERNEL ); if ( ! elf_interpreter )  retval = kernel_read ( bprm -> file , elf_ppnt -> p_offset , elf_interpreter , elf_ppnt -> p_filesz ); if ( retval != elf_ppnt -> p_filesz )  retval = - ENOEXEC; if ( elf_interpreter [ elf_ppnt -> p_filesz - 1 ] != '\0' )  interpreter = open_exec ( elf_interpreter ); retval = PTR_ERR ( interpreter ); if ( IS_ERR ( interpreter ) )  if ( file_permission ( interpreter , MAY_READ ) < 0 )  bprm -> interp_flags |= BINPRM_FLAGS_ENFORCE_NONDUMP; retval = kernel_read ( interpreter , 0 , bprm -> buf , BINPRM_BUF_SIZE ); if ( retval != BINPRM_BUF_SIZE )  loc -> interp_elf_ex = * ( ( struct elfhdr * ) bprm -> buf ); elf_ppnt ++; if ( elf_interpreter )  if ( memcmp ( loc -> interp_elf_ex . e_ident , ELFMAG , SELFMAG ) != 0 )  