All of lore.kernel.org
 help / color / mirror / Atom feed
From: Oleg Nesterov <oleg@redhat.com>
To: Andrew Morton <akpm@linux-foundation.org>,
	Zach Levis <zml@linux.vnet.ibm.com>
Cc: Al Viro <viro@ZenIV.linux.org.uk>,
	Evgeniy Polyakov <zbr@ioremap.net>,
	Kees Cook <keescook@chromium.org>,
	linux-kernel@vger.kernel.org
Subject: [PATCH 1/5] exec: move allow_write_access/fput to exec_binprm()
Date: Fri, 2 Aug 2013 21:27:34 +0200	[thread overview]
Message-ID: <20130802192734.GA9565@redhat.com> (raw)
In-Reply-To: <20130802192713.GA9543@redhat.com>

When search_binary_handler() succeeds it does allow_write_access()
and fput(), then it clears bprm->file to ensure the caller will not
do the same.

We can simply move this code to exec_binprm() which is called only
once. In fact we could move this to free_bprm() and remove the same
code in do_execve_common's error path.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
---
 fs/exec.c |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index ad7d624..ef70320 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1400,10 +1400,6 @@ int search_binary_handler(struct linux_binprm *bprm)
 			bprm->recursion_depth--;
 			if (retval >= 0) {
 				put_binfmt(fmt);
-				allow_write_access(bprm->file);
-				if (bprm->file)
-					fput(bprm->file);
-				bprm->file = NULL;
 				return retval;
 			}
 			read_lock(&binfmt_lock);
@@ -1455,6 +1451,11 @@ static int exec_binprm(struct linux_binprm *bprm)
 		ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
 		current->did_exec = 1;
 		proc_exec_connector(current);
+
+		if (bprm->file) {
+			allow_write_access(bprm->file);
+			fput(bprm->file);
+		}
 	}
 
 	return ret;
-- 
1.5.5.1


  reply	other threads:[~2013-08-02 19:33 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-08-02 19:27 [PATCH 0/5] exec: more cleanups Oleg Nesterov
2013-08-02 19:27 ` Oleg Nesterov [this message]
2013-08-03 19:27   ` [PATCH 1/5] exec: move allow_write_access/fput to exec_binprm() Kees Cook
2013-08-04 14:48     ` Oleg Nesterov
2013-08-02 19:27 ` [PATCH 2/5] exec: kill ->load_binary != NULL check in search_binary_handler() Oleg Nesterov
2013-08-02 19:27 ` [PATCH 3/5] exec: cleanup the CONFIG_MODULES logic Oleg Nesterov
2013-08-02 19:27 ` [PATCH 4/5] exec: don't retry if request_module() fails Oleg Nesterov
2013-08-02 19:27 ` [PATCH 5/5] exec: cleanup the error handling in search_binary_handler() Oleg Nesterov
2013-08-03 19:28 ` [PATCH 0/5] exec: more cleanups Kees Cook

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20130802192734.GA9565@redhat.com \
    --to=oleg@redhat.com \
    --cc=akpm@linux-foundation.org \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=viro@ZenIV.linux.org.uk \
    --cc=zbr@ioremap.net \
    --cc=zml@linux.vnet.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.