[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 10 Oct 2017 14:04:02 +0200
From: Oleg Nesterov <oleg@...hat.com>
To: Tycho Andersen <tycho@...ho.ws>
Cc: Kees Cook <keescook@...omium.org>, linux-kernel@...r.kernel.org
Subject: Re: null dereference in binfmt misc
On 10/10, Oleg Nesterov wrote:
>
> On 10/09, Tycho Andersen wrote:
> > Hi,
> >
> > It looks like eb23aa031 ("exec: binfmt_misc: remove the confusing
> > e->interp_file != NULL checks") uncovered a bug for me (see the trace below,
> > which I'm afraid isn't very helpful).
>
> Well, I think this commit uncovered the fact I am stupid, although there is
> nothing new. I forgot about iput() in bm_register_write's error paths, it can
> be called with MISC_FMT_OPEN_FILE && interp_file == NULL.
>
> I'll try to cleanup bm_register_write() to make this impossible, or perhaps
> I will just restore the interp_file != NULL check in evict.
Yes, but...
> Before that, could you please try the debugging patch below? To ensure you
> didn't hit another problem.
please ignore. scripts/decodecode suggests you hit another problem,
inode->i_private is NULL.
I'll send the patch today, thanks.
Oleg.
Powered by blists - more mailing lists