linux-kernel - Re: [syzbot] Re: kernel BUG in free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ne4dsdjh7tcp7ndgqa7qx2ouhkioowr52wunfnikykq5v2z2zs@tfshc7af2eql>
Date: Tue, 5 Nov 2024 15:33:16 +0200
From: "Kirill A. Shutemov" <kirill@...temov.name>
To: syzbot <syzbot+03e1af5c332f7e0eb84b@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] Re: kernel BUG in free_bprm()

On Tue, Nov 05, 2024 at 03:17:51AM -0800, syzbot wrote:
> For archival purposes, forwarding an incoming command email to
> linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.
> 
> ***
> 
> Subject: Re: kernel BUG in free_bprm()
> Author: dmantipov@...dex.ru
> 
> #syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next 850f22c42f4b0a14a015aecc26f46f9948ded6dd
> 
> diff --git a/fs/exec.c b/fs/exec.c
> index ef18eb0ea5b4..df70ed8e36fe 100644
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -1496,7 +1496,8 @@ static void free_bprm(struct linux_binprm *bprm)
>  	if (bprm->interp != bprm->filename)
>  		kfree(bprm->interp);
>  	kfree(bprm->fdpath);
> -	kfree(bprm->argv0);
> +	if (!IS_ERR(bprm->argv0))
> +		kfree(bprm->argv0);
>  	kfree(bprm);
>  }

It's better to avoid setting bprm->argv0 if strndup_user() fails.

diff --git a/fs/exec.c b/fs/exec.c
index ef18eb0ea5b4..9380e166eff5 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1504,6 +1504,7 @@ static int bprm_add_fixup_comm(struct linux_binprm *bprm,
 			       struct user_arg_ptr argv)
 {
 	const char __user *p = get_user_arg_ptr(argv, 0);
+	char *argv0;
 
 	/*
 	 * If p == NULL, let's just fall back to fdpath.
@@ -1511,10 +1512,11 @@ static int bprm_add_fixup_comm(struct linux_binprm *bprm,
 	if (!p)
 		return 0;
 
-	bprm->argv0 = strndup_user(p, MAX_ARG_STRLEN);
-	if (IS_ERR(bprm->argv0))
-		return PTR_ERR(bprm->argv0);
+	argv0 = strndup_user(p, MAX_ARG_STRLEN);
+	if (IS_ERR(argv0))
+		return PTR_ERR(argv0);
 
+	bprm->argv0 = argv0;
 	return 0;
 }
 
-- 
  Kiryl Shutsemau / Kirill A. Shutemov