xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

exec: Make unlocking exec_update_mutex explict

Browse Source 
With install_exec_creds updated to follow immediately after
setup_new_exec, the failure of unshare_sighand is the only
code path where exec_update_mutex is held but not explicitly
unlocked.

Update that code path to explicitly unlock exec_update_mutex.

Remove the unlocking of exec_update_mutex from free_bprm.

Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Greg Ungerer <gerg@linux-m68k.org>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
This commit is contained in:
Eric W. Biederman
2020-04-02 18:04:54 -05:00
parent e7f7785449
commit 89826cce37
2 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
fs/exec.c
View File

@@ -1344,7 +1344,7 @@ int flush_old_exec(struct linux_binprm * bprm)
*/ */
retval = unshare_sighand(me); retval = unshare_sighand(me);
if (retval) if (retval)
goto out; goto out_unlock;
set_fs(USER_DS); set_fs(USER_DS);
me->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD | me->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD |
@@ -1361,6 +1361,8 @@ int flush_old_exec(struct linux_binprm * bprm)
do_close_on_exec(me->files); do_close_on_exec(me->files);
return 0; return 0;
out_unlock:
mutex_unlock(&me->signal->exec_update_mutex);
out: out:
return retval; return retval;
} }
@@ -1477,8 +1479,6 @@ static void free_bprm(struct linux_binprm *bprm)
{ {
free_arg_pages(bprm); free_arg_pages(bprm);
if (bprm->cred) { if (bprm->cred) {
if (bprm->called_exec_mmap)
mutex_unlock(&current->signal->exec_update_mutex);
mutex_unlock(&current->signal->cred_guard_mutex); mutex_unlock(&current->signal->cred_guard_mutex);
abort_creds(bprm->cred); abort_creds(bprm->cred);
} }

3
include/linux/binfmts.h
View File

@@ -47,8 +47,7 @@ struct linux_binprm {
secureexec:1, secureexec:1,
/* /*
* Set by flush_old_exec, when exec_mmap has been called. * Set by flush_old_exec, when exec_mmap has been called.
* This is past the point of no return, when the * This is past the point of no return.
* exec_update_mutex has been taken.
*/ */
called_exec_mmap:1; called_exec_mmap:1;
#ifdef __alpha__ #ifdef __alpha__