Skip to content

Commit

Permalink
[PATCH] sanitize handling of shared descriptor tables in failing exec…
Browse files Browse the repository at this point in the history 
…ve()

* unshare_files() can fail; doing it after irreversible actions is wrong
  and de_thread() is certainly irreversible.
* since we do it unconditionally anyway, we might as well do it in do_execve()
  and save ourselves the PITA in binfmt handlers, etc.
* while we are at it, binfmt_som actually leaked files_struct on failure.

As a side benefit, unshare_files(), put_files_struct() and reset_files_struct()
become unexported.

Signed-off-by: Al Viro <[email protected]>
  • Loading branch information
Al Viro committed Apr 25, 2008
1 parent 6b335d9 commit fd8328b
Show file tree
Hide file tree
Showing 6 changed files with 20 additions and 70 deletions.
23 changes: 1 addition & 22 deletions fs/binfmt_elf.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -543,7 +543,6 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
unsigned long interp_load_addr = 0;
unsigned long start_code, end_code, start_data, end_data;
unsigned long reloc_func_desc = 0;
struct files_struct *files;
int executable_stack = EXSTACK_DEFAULT;
unsigned long def_flags = 0;
struct {
Expand Down Expand Up @@ -593,20 +592,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
goto out_free_ph;
}

files = current->files; /* Refcounted so ok */
retval = unshare_files();
if (retval < 0)
goto out_free_ph;
if (files == current->files) {
put_files_struct(files);
files = NULL;
}

/* exec will make our files private anyway, but for the a.out
loader stuff we need to do it earlier */
retval = get_unused_fd();
if (retval < 0)
goto out_free_fh;
goto out_free_ph;
get_file(bprm->file);
fd_install(elf_exec_fileno = retval, bprm->file);

Expand Down Expand Up @@ -728,12 +716,6 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
if (retval)
goto out_free_dentry;

/* Discard our unneeded old files struct */
if (files) {
put_files_struct(files);
files = NULL;
}

/* OK, This is the point of no return */
current->flags &= ~PF_FORKNOEXEC;
current->mm->def_flags = def_flags;
Expand Down Expand Up @@ -1016,9 +998,6 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
kfree(elf_interpreter);
out_free_file:
sys_close(elf_exec_fileno);
out_free_fh:
if (files)
reset_files_struct(current, files);
out_free_ph:
kfree(elf_phdata);
goto out;
Expand Down
18 changes: 1 addition & 17 deletions fs/binfmt_misc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
char *iname_addr = iname;
int retval;
int fd_binary = -1;
struct files_struct *files = NULL;

retval = -ENOEXEC;
if (!enabled)
Expand All @@ -133,21 +132,13 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)

if (fmt->flags & MISC_FMT_OPEN_BINARY) {

files = current->files;
retval = unshare_files();
if (retval < 0)
goto _ret;
if (files == current->files) {
put_files_struct(files);
files = NULL;
}
/* if the binary should be opened on behalf of the
* interpreter than keep it open and assign descriptor
* to it */
fd_binary = get_unused_fd();
if (fd_binary < 0) {
retval = fd_binary;
goto _unshare;
goto _ret;
}
fd_install(fd_binary, bprm->file);

Expand Down Expand Up @@ -205,20 +196,13 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
if (retval < 0)
goto _error;

if (files) {
put_files_struct(files);
files = NULL;
}
_ret:
return retval;
_error:
if (fd_binary > 0)
sys_close(fd_binary);
bprm->interp_flags = 0;
bprm->interp_data = 0;
_unshare:
if (files)
reset_files_struct(current, files);
goto _ret;
}

Expand Down
10 changes: 0 additions & 10 deletions fs/binfmt_som.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -194,7 +194,6 @@ load_som_binary(struct linux_binprm * bprm, struct pt_regs * regs)
unsigned long som_entry;
struct som_hdr *som_ex;
struct som_exec_auxhdr *hpuxhdr;
struct files_struct *files;

/* Get the exec-header */
som_ex = (struct som_hdr *) bprm->buf;
Expand All @@ -221,15 +220,6 @@ load_som_binary(struct linux_binprm * bprm, struct pt_regs * regs)
goto out_free;
}

files = current->files; /* Refcounted so ok */
retval = unshare_files();
if (retval < 0)
goto out_free;
if (files == current->files) {
put_files_struct(files);
files = NULL;
}

retval = get_unused_fd();
if (retval < 0)
goto out_free;
Expand Down
34 changes: 18 additions & 16 deletions fs/exec.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -953,7 +953,6 @@ int flush_old_exec(struct linux_binprm * bprm)
{
char * name;
int i, ch, retval;
struct files_struct *files;
char tcomm[sizeof(current->comm)];

/*
Expand All @@ -964,27 +963,16 @@ int flush_old_exec(struct linux_binprm * bprm)
if (retval)
goto out;

/*
* Make sure we have private file handles. Ask the
* fork helper to do the work for us and the exit
* helper to do the cleanup of the old one.
*/
files = current->files; /* refcounted so safe to hold */
retval = unshare_files();
if (retval)
goto out;
/*
* Release all of the old mmap stuff
*/
retval = exec_mmap(bprm->mm);
if (retval)
goto mmap_failed;
goto out;

bprm->mm = NULL; /* We're using it now */

/* This is the point of no return */
put_files_struct(files);

current->sas_ss_sp = current->sas_ss_size = 0;

if (current->euid == current->uid && current->egid == current->gid)
Expand Down Expand Up @@ -1034,8 +1022,6 @@ int flush_old_exec(struct linux_binprm * bprm)

return 0;

mmap_failed:
reset_files_struct(current, files);
out:
return retval;
}
Expand Down Expand Up @@ -1283,12 +1269,23 @@ int do_execve(char * filename,
struct linux_binprm *bprm;
struct file *file;
unsigned long env_p;
struct files_struct *files;
int retval;

files = current->files;
retval = unshare_files();
if (retval)
goto out_ret;

if (files == current->files) {
put_files_struct(files);
files = NULL;
}

retval = -ENOMEM;
bprm = kzalloc(sizeof(*bprm), GFP_KERNEL);
if (!bprm)
goto out_ret;
goto out_files;

file = open_exec(filename);
retval = PTR_ERR(file);
Expand Down Expand Up @@ -1343,6 +1340,8 @@ int do_execve(char * filename,
security_bprm_free(bprm);
acct_update_integrals(current);
kfree(bprm);
if (files)
put_files_struct(files);
return retval;
}

Expand All @@ -1363,6 +1362,9 @@ int do_execve(char * filename,
out_kfree:
kfree(bprm);

out_files:
if (files)
reset_files_struct(current, files);
out_ret:
return retval;
}
Expand Down
3 changes: 0 additions & 3 deletions kernel/exit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -507,8 +507,6 @@ void put_files_struct(struct files_struct *files)
}
}

EXPORT_SYMBOL(put_files_struct);

void reset_files_struct(struct task_struct *tsk, struct files_struct *files)
{
struct files_struct *old;
Expand All @@ -519,7 +517,6 @@ void reset_files_struct(struct task_struct *tsk, struct files_struct *files)
task_unlock(tsk);
put_files_struct(old);
}
EXPORT_SYMBOL(reset_files_struct);

void exit_files(struct task_struct *tsk)
{
Expand Down
2 changes: 0 additions & 2 deletions kernel/fork.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -870,8 +870,6 @@ int unshare_files(void)
return error;
}

EXPORT_SYMBOL(unshare_files);

static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
{
struct sighand_struct *sig;
Expand Down

0 comments on commit fd8328b

Please sign in to comment.