mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
51 lines
1.4 KiB
Diff
51 lines
1.4 KiB
Diff
|
From be1421e7f5948f7c9f7ff351ec47c19da7498686 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Andrea Arcangeli <andrea@cpushare.com>
|
||
|
|
Date: Tue, 25 Jul 2017 22:22:45 +0200
|
||
|
|
Subject: [PATCH] fs/exec: fix use after free in execve
|
||
|
|
|
||
|
|
"file" can be already freed if bprm->file is NULL after
|
||
|
|
search_binary_handler() return. binfmt_script will do exactly that for
|
||
|
|
example. If the VM reuses the file after fput run(), this will result in
|
||
|
|
a use ater free.
|
||
|
|
|
||
|
|
So obtain d_is_su before search_binary_handler() runs.
|
||
|
|
|
||
|
|
This should explain this crash:
|
||
|
|
|
||
|
|
[25333.009554] Unable to handle kernel NULL pointer dereference at virtual address 00000185
|
||
|
|
[..]
|
||
|
|
[25333.009918] [2: am:21861] PC is at do_execve+0x354/0x474
|
||
|
|
|
||
|
|
Change-Id: I2a8a814d1c0aa75625be83cb30432cf13f1a0681
|
||
|
|
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
|
||
|
|
---
|
||
|
|
|
||
|
|
diff --git a/fs/exec.c b/fs/exec.c
|
||
|
|
index 73e9bd4..5d2a2f0 100644
|
||
|
|
--- a/fs/exec.c
|
||
|
|
+++ b/fs/exec.c
|
||
|
|
@@ -1511,6 +1511,7 @@
|
||
|
|
bool clear_in_exec;
|
||
|
|
int retval;
|
||
|
|
const struct cred *cred = current_cred();
|
||
|
|
+ bool is_su;
|
||
|
|
|
||
|
|
/*
|
||
|
|
* We move the actual failure in case of RLIMIT_NPROC excess from
|
||
|
|
@@ -1587,11 +1588,14 @@
|
||
|
|
if (retval < 0)
|
||
|
|
goto out;
|
||
|
|
|
||
|
|
+ /* search_binary_handler can release file and it may be freed */
|
||
|
|
+ is_su = d_is_su(file->f_dentry);
|
||
|
|
+
|
||
|
|
retval = search_binary_handler(bprm,regs);
|
||
|
|
if (retval < 0)
|
||
|
|
goto out;
|
||
|
|
|
||
|
|
- if (d_is_su(file->f_dentry) && capable(CAP_SYS_ADMIN)) {
|
||
|
|
+ if (is_su && capable(CAP_SYS_ADMIN)) {
|
||
|
|
current->flags |= PF_SU;
|
||
|
|
su_exec();
|
||
|
|
}
|