Re: [PATCH 01/21] exec: do not act on a stale execfd request without an executable

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the patch fails to fix it completely. It fails to clear leaked `have_execfd` and `execfd_creds` flags if the fallback format uses an interpreter (e.g., `binfmt_script`), potentially allowing setuid script execution.
--

--- Patch [1]: [PATCH 01/21] exec: do not act on a stale execfd request without an executable ---
commit 9dcfa7daaba6407f79aa884e4fa9f0bc5d755870
Author: Christian Brauner <brauner@kernel.org>

exec: do not act on a stale execfd request without an executable

This commit addresses an issue where binfmt_misc leaves bprm->have_execfd
and bprm->execfd_creds set when it fails to open an interpreter. It clears
these flags in begin_new_exec() if bprm->executable is NULL to prevent a
subsequent NULL pointer dereference.

> diff --git a/fs/exec.c b/fs/exec.c
> index c698aabe9abd0..2f50aa0398278 100644
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -1112,6 +1112,12 @@ int begin_new_exec(struct linux_binprm * bprm)
>  	struct task_struct *me = current;
>  	int retval;
>  
> +	/* A declined execfd request has no executable for a later format. */
> +	if (!bprm->executable) {
> +		bprm->have_execfd = 0;
> +		bprm->execfd_creds = 0;
> +	}

[Severity: High]
This isn't a bug introduced by this patch, but does this check completely
resolve the leaked flags issue?

If load_misc_binary() leaks the have_execfd flag and the kernel falls back to
binfmt_script, it looks like exec_binprm() might unconditionally consume the
leaked flag and set bprm->executable to the script:

fs/exec.c:exec_binprm() {
    ...
    if (unlikely(bprm->have_execfd)) {
        if (bprm->executable) {
            fput(exec);
            return -ENOEXEC;
        }
        bprm->executable = exec;
    } else
    ...
}

In the case of a setuid script with a statically linked interpreter (like
#!/sbin/busybox.static sh), would this cause begin_new_exec() to see a
non-NULL bprm->executable?

If so, would it bypass this cleanup and compute credentials from the script
rather than the interpreter, potentially honoring the setuid bit on the script?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720-work-bpf-binfmt_misc-ptinterp-v1-0-ddb76c9a508e@kernel.org?part=1