linux-kernel - Re: [Patch 7/9] fs/exec.c: fix wrong return value of prepare

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080512043758.GP13907@ZenIV.linux.org.uk>
Date:	Mon, 12 May 2008 05:37:58 +0100
From:	Al Viro <viro@...IV.linux.org.uk>
To:	WANG Cong <xiyou.wangcong@...il.com>
Cc:	LKML <linux-kernel@...r.kernel.org>, Andrew Morton <akpm@...l.org>,
	WANG Cong <wangcong@...ux.org>
Subject: Re: [Patch 7/9] fs/exec.c: fix wrong return value of
	prepare_binprm()

On Mon, May 12, 2008 at 12:15:34PM +0800, WANG Cong wrote:
> And even if it is really "binary is corrupted", then -ENOEXEC is
> better than -EINVAL, isn't it?
> 
> Anyway, kernel_read() may return postive when not success.

???

It returns positives *exactly* on success.  In the case you've quoted
we don't have any problems with read; we do have a problem with _short_
read (i.e. miscalculated field size or truncated binary).  In the case
you've patched we _expect_ a short read; it's normal for short scripts,
to start with.  And we are ready to deal with it - the buffer is prefilled
with zeroes and either we have enough to recognize signature (in which case
we'll find the binfmt handler and let it deal with the entire thing, with
full checks of its own) or we will not, in which case nobody will recognize
the damn thing and that's it.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/