lkml.org 
[lkml]   [2009]   [Mar]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH 1/4] compat_do_execve should unshare_files
    2.6.26's commit fd8328be874f4190a811c58cd4778ec2c74d2c05
    "sanitize handling of shared descriptor tables in failing execve()"
    moved the unshare_files() from flush_old_exec() and several binfmts
    to the head of do_execve(); but forgot to make the same change to
    compat_do_execve(), leaving a CLONE_FILES files_struct shared across
    exec from a 32-bit process on a 64-bit kernel.

    It's arguable whether the files_struct really ought to be unshared
    across exec; but 2.6.1 made that so to stop the loading binary's fd
    leaking into other threads, and a 32-bit process on a 64-bit kernel
    ought to behave in the same way as 32 on 32 and 64 on 64.

    Signed-off-by: Hugh Dickins <hugh@veritas.com>
    Cc: stable@kernel.org
    ---

    fs/compat.c | 12 +++++++++++-
    1 file changed, 11 insertions(+), 1 deletion(-)

    --- 2.6.29/fs/compat.c 2009-03-23 23:12:14.000000000 +0000
    +++ linux/fs/compat.c 2009-03-28 18:06:02.000000000 +0000
    @@ -1392,12 +1392,17 @@ int compat_do_execve(char * filename,
    {
    struct linux_binprm *bprm;
    struct file *file;
    + struct files_struct *displaced;
    int retval;

    + retval = unshare_files(&displaced);
    + if (retval)
    + goto out_ret;
    +
    retval = -ENOMEM;
    bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
    if (!bprm)
    - goto out_ret;
    + goto out_files;

    retval = mutex_lock_interruptible(&current->cred_exec_mutex);
    if (retval < 0)
    @@ -1457,6 +1462,8 @@ int compat_do_execve(char * filename,
    mutex_unlock(&current->cred_exec_mutex);
    acct_update_integrals(current);
    free_bprm(bprm);
    + if (displaced)
    + put_files_struct(displaced);
    return retval;

    out:
    @@ -1475,6 +1482,9 @@ out_unlock:
    out_free:
    free_bprm(bprm);

    +out_files:
    + if (displaced)
    + reset_files_struct(displaced);
    out_ret:
    return retval;
    }

    \
     
     \ /
      Last update: 2009-03-29 00:19    [W:3.204 / U:0.248 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site