exec: binfmt_misc: fix use-after-free, kill iname[BINPRM_BUF_SIZE]
Status from this message: [merged] exec-binfmt_misc-kill-the-onstack-iname-array.patch removed from -mm tree
Get series with b4
b4 am [email protected]Versions newest first
Patches in v1 All 5 applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/5 | exec: binfmt_misc: don't nullify Node->dentry in kill_node()fs/ | +9 | 0 replies | Applied |
| 2/5 | exec: binfmt_misc: shift filp_close(interp_file) from kill_node() to bm_evict_inode()fs/ | +6 | 0 replies | Applied |
| 3/5 | exec: binfmt_misc: remove the confusing e->interp_file != NULL checksfs/ | +2 | 0 replies | Applied |
| 4/5 | exec: binfmt_misc: fix race between load_misc_binary() and kill_node()fs/ | +8 | 0 replies | Applied |
| 5/5 | exec: binfmt_misc: kill the onstack iname[BINPRM_BUF_SIZE] arrayfs/ | +5 | 0 replies | Applied |
Reviews trailers per patch
None of the 5 patches has a Reviewed-by or Acked-by of their own; the series has one for all of them.
| Patch | Kees Cook |
|---|---|
| Series | A-b |
| 1/5 | |
| 2/5 | |
| 3/5 | |
| 4/5 | |
| 5/5 |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH 0/5] exec: binfmt_misc: fix use-after-free, kill iname[BINPRM_BUF_SIZE]
Note: 5/5 depends on
-extern int bprm_change_interp(char *interp, struct linux_binprm *bprm); +extern int bprm_change_interp(const char *interp, struct linux_binprm *bprm);
change in
[PATCH] exec: load_script: kill the onstack interp[BINPRM_BUF_SIZE] array https://marc.info/?l=linux-kernel&m=150575251328591
I sent before.
Looks like this code was always wrong, then 948b701a607f ("binfmt_misc: add persistent opened binary handler for containers") added more problems.
Oleg.
fs/binfmt_misc.c | 56 ++++++++++++++++++++++++++------------------------------ 1 file changed, 26 insertions(+), 30 deletions(-)