tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

exec: fix the racy usage of fs_struct->in_exec

Browse Source 
commit af7bb0d2ca459f15cb5ca604dab5d9af103643f0 upstream.

check_unsafe_exec() sets fs->in_exec under cred_guard_mutex, then execve()
paths clear fs->in_exec lockless. This is fine if exec succeeds, but if it
fails we have the following race:

	T1 sets fs->in_exec = 1, fails, drops cred_guard_mutex

	T2 sets fs->in_exec = 1

	T1 clears fs->in_exec

	T2 continues with fs->in_exec == 0

Change fs/exec.c to clear fs->in_exec with cred_guard_mutex held.

Reported-by: syzbot+1c486d0b62032c82a968@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/67dc67f0.050a0220.25ae54.001f.GAE@google.com/
Cc: stable@vger.kernel.org
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/r/20250324160003.GA8878@redhat.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Oleg Nesterov
2025-03-24 17:00:03 +01:00
committed by Greg Kroah-Hartman
parent 747e3eec1d
commit e2d8e7bd33
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/exec.c
+9 -6
View File
@@ -1246,13 +1246,12 @@ int begin_new_exec(struct linux_binprm * bprm)
*/ */
bprm->point_of_no_return = true; bprm->point_of_no_return = true;
/* /* Make this the only thread in the thread group */
* Make this the only thread in the thread group.
*/
retval = de_thread(me); retval = de_thread(me);
if (retval) if (retval)
goto out; goto out;
/* see the comment in check_unsafe_exec() */
current->fs->in_exec = 0;
/* /*
* Cancel any io_uring activity across execve * Cancel any io_uring activity across execve
*/ */
@@ -1514,6 +1513,8 @@ static void free_bprm(struct linux_binprm *bprm)
} }
free_arg_pages(bprm); free_arg_pages(bprm);
if (bprm->cred) { if (bprm->cred) {
/* in case exec fails before de_thread() succeeds */
current->fs->in_exec = 0;
mutex_unlock(&current->signal->cred_guard_mutex); mutex_unlock(&current->signal->cred_guard_mutex);
abort_creds(bprm->cred); abort_creds(bprm->cred);
} }
@@ -1620,6 +1621,10 @@ static void check_unsafe_exec(struct linux_binprm *bprm)
* suid exec because the differently privileged task * suid exec because the differently privileged task
* will be able to manipulate the current directory, etc. * will be able to manipulate the current directory, etc.
* It would be nice to force an unshare instead... * It would be nice to force an unshare instead...
*
* Otherwise we set fs->in_exec = 1 to deny clone(CLONE_FS)
* from another sub-thread until de_thread() succeeds, this
* state is protected by cred_guard_mutex we hold.
*/ */
n_fs = 1; n_fs = 1;
spin_lock(&p->fs->lock); spin_lock(&p->fs->lock);
@@ -1878,7 +1883,6 @@ static int bprm_execve(struct linux_binprm *bprm)
sched_mm_cid_after_execve(current); sched_mm_cid_after_execve(current);
/* execve succeeded */ /* execve succeeded */
current->fs->in_exec = 0;
current->in_execve = 0; current->in_execve = 0;
rseq_execve(current); rseq_execve(current);
user_events_execve(current); user_events_execve(current);
@@ -1897,7 +1901,6 @@ out:
force_fatal_sig(SIGSEGV); force_fatal_sig(SIGSEGV);
sched_mm_cid_after_execve(current); sched_mm_cid_after_execve(current);
current->fs->in_exec = 0;
current->in_execve = 0; current->in_execve = 0;
return retval; return retval;