From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Tue, 26 Mar 2013 13:25:04 -0700 From: Greg Kroah-Hartman To: Ben Hutchings Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com, Kees Cook , halfdog , P J P , Alexander Viro , Andrew Morton , Linus Torvalds , Luis Henriques Subject: Re: [PATCH 42/88] exec: use -ELOOP for max recursion depth Message-ID: <20130326202504.GE21624@kroah.com> References: <1363257381-15900-1-git-send-email-luis.henriques@canonical.com> <1363257381-15900-43-git-send-email-luis.henriques@canonical.com> <1363661587.3937.360.camel@deadeye.wl.decadent.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1363661587.3937.360.camel@deadeye.wl.decadent.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: On Tue, Mar 19, 2013 at 02:53:07AM +0000, Ben Hutchings wrote: > On Thu, 2013-03-14 at 10:35 +0000, Luis Henriques wrote: > > 3.5.7.8 -stable review patch. If anyone has any objections, please let me know. > > > > ------------------ > > > > From: Kees Cook > > > > commit d740269867021faf4ce38a449353d2b986c34a67 upstream. > > > > To avoid an explosion of request_module calls on a chain of abusive > > scripts, fail maximum recursion with -ELOOP instead of -ENOEXEC. As soon > > as maximum recursion depth is hit, the error will fail all the way back > > up the chain, aborting immediately. > > > > This also has the side-effect of stopping the user's shell from attempting > > to reexecute the top-level file as a shell script. As seen in the > > dash source: > > > > if (cmd != path_bshell && errno == ENOEXEC) { > > *argv-- = cmd; > > *argv = cmd = path_bshell; > > goto repeat; > > } > > > > The above logic was designed for running scripts automatically that lacked > > the "#!" header, not to re-try failed recursion. On a legitimate -ENOEXEC, > > things continue to behave as the shell expects. > > > > Additionally, when tracking recursion, the binfmt handlers should not be > > involved. The recursion being tracked is the depth of calls through > > search_binary_handler(), so that function should be exclusively responsible > > for tracking the depth. > > > > Signed-off-by: Kees Cook > > Cc: halfdog > > Cc: P J P > > Cc: Alexander Viro > > Signed-off-by: Andrew Morton > > Signed-off-by: Linus Torvalds > > [ luis: backport to 3.5 ] > > Signed-off-by: Luis Henriques > [...] > > Greg, I also included this in 3.2.y (commit 511d07b) but it is missing > from 3.0.y and 3.4.y. I hope one or other of these backports will be > suitable for them (it was just a context fix for 3.2.y). Applied, thanks. greg k-h