exec: load_script: kill the onstack interp[BINPRM_BUF_SIZE] array
authorOleg Nesterov <[email protected]>
Tue, 3 Oct 2017 23:15:42 +0000 (16:15 -0700)
committerLinus Torvalds <[email protected]>
Wed, 4 Oct 2017 00:54:25 +0000 (17:54 -0700)
commitc2315c187fa0d3ab363fdebe22718170b40473e3
treebb42cc9d6cc3cf4d0f70f6dad289650fce3c757d
parent384632e67e0829deb8015ee6ad916b180049d252
exec: load_script: kill the onstack interp[BINPRM_BUF_SIZE] array

Patch series "exec: binfmt_misc: fix use-after-free, kill
iname[BINPRM_BUF_SIZE]".

It looks like this code was always wrong, then commit 948b701a607f
("binfmt_misc: add persistent opened binary handler for containers")
added more problems.

This patch (of 6):

load_script() can simply use i_name instead, it points into bprm->buf[]
and nobody can change this memory until we call prepare_binprm().

The only complication is that we need to also change the signature of
bprm_change_interp() but this change looks good too.

While at it, do whitespace/style cleanups.

NOTE: the real motivation for this change is that people want to
increase BINPRM_BUF_SIZE, we need to change load_misc_binary() too but
this looks more complicated because afaics it is very buggy.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Oleg Nesterov <[email protected]>
Acked-by: Kees Cook <[email protected]>
Cc: Travis Gummels <[email protected]>
Cc: Ben Woodard <[email protected]>
Cc: Jim Foraker <[email protected]>
Cc: <[email protected]>
Cc: Al Viro <[email protected]>
Cc: James Bottomley <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
fs/binfmt_script.c
fs/exec.c
include/linux/binfmts.h