Oleg Nesterov 83f918274e exec: binfmt_misc: shift filp_close(interp_file) from kill_node() to bm_evict_inode() ...

To ensure that load_misc_binary() can't use the partially destroyed
Node, see also the next patch.

The current logic looks wrong in any case, once we close interp_file it
doesn't make any sense to delay kfree(inode->i_private), this Node is no
longer valid.  Even if the MISC_FMT_OPEN_FILE/interp_file checks were
not racy (they are), load_misc_binary() should not try to reopen
->interpreter if MISC_FMT_OPEN_FILE is set but ->interp_file is NULL.

And I can't understand why do we use filp_close(), not fput().

Link: http://lkml.kernel.org/r/20170922143644.GA17216@redhat.com
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Ben Woodard <woodard@redhat.com>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Jim Foraker <foraker1@llnl.gov>
Cc: <tdhooge@llnl.gov>
Cc: Travis Gummels <tgummels@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2017-10-03 17:54:25 -07:00

..

9p

Merge branch 'akpm' (patches from Andrew)

2017-09-06 20:49:49 -07:00

adfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2016-10-10 20:16:43 -07:00

affs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

afs

Merge branch 'akpm' (patches from Andrew)

2017-09-06 20:49:49 -07:00

autofs4

Merge branch 'work.set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:13:32 -07:00

befs

VFS: Convert sb->s_flags & MS_RDONLY to sb_rdonly(sb)

2017-07-17 08:45:34 +01:00

bfs

bfs: fix sanity checks for empty files

2017-07-12 16:26:00 -07:00

btrfs

Merge branch 'for-4.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

2017-09-29 12:57:35 -07:00

cachefiles

VFS: Convert sb->s_flags & MS_RDONLY to sb_rdonly(sb)

2017-07-17 08:45:34 +01:00

ceph

ceph: avoid panic in create_session_open_msg() if utsname() returns NULL

2017-09-19 21:04:52 +02:00

cifs

SMB3: Don't ignore O_SYNC/O_DSYNC and O_DIRECT flags

2017-09-22 19:47:17 -05:00

coda

fs: fix kernel_read prototype

2017-09-04 19:05:15 -04:00

configfs

configfs: Introduce config_item_get_unless_zero()

2017-06-12 13:20:20 +02:00

cramfs

…

crypto

block: replace bi_bdev with a gendisk pointer and partitions index

2017-08-23 12:49:55 -06:00

debugfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

devpts

pty: Repair TIOCGPTPEER

2017-08-24 13:23:03 -07:00

dlm

File locking related changes for v4.14

2017-09-06 13:43:26 -07:00

ecryptfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

efivarfs

VFS: Kill off s_options and helpers

2017-07-11 06:09:21 -04:00

efs

VFS: Convert sb->s_flags & MS_RDONLY to sb_rdonly(sb)

2017-07-17 08:45:34 +01:00

exofs

Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block

2017-09-07 11:59:42 -07:00

exportfs

Merge branch 'rebased-statx' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-03-03 11:38:56 -08:00

ext2

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

ext4

Merge branch 'work.read_write' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 19:29:55 -07:00

f2fs

for-f2fs-4.14

2017-09-12 20:05:58 -07:00

fat

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

freevxfs

…

fscache

fscache: fix fscache_objlist_show format processing

2017-09-13 18:53:15 -07:00

fuse

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse

2017-09-13 10:10:19 -07:00

gfs2

GFS2: Fix an old regression in GFS2's debugfs interface

2017-09-25 15:41:56 -07:00

hfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

hfsplus

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

hostfs

fs: convert a pile of fsync routines to errseq_t based reporting

2017-08-01 08:39:29 -04:00

hpfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

hugetlbfs

lib/interval_tree: fast overlap detection

2017-09-08 18:26:49 -07:00

isofs

isofs: fix build regression

2017-09-18 12:24:26 +02:00

jbd2

Writeback error handling fixes (pile #2)

2017-07-07 19:38:17 -07:00

jffs2

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

jfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

kernfs

Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block

2017-09-07 11:59:42 -07:00

lockd

NFS client updates for Linux 4.14

2017-09-11 22:01:44 -07:00

minix

VFS: Convert sb->s_flags & MS_RDONLY to sb_rdonly(sb)

2017-07-17 08:45:34 +01:00

ncpfs

fs: convert a pile of fsync routines to errseq_t based reporting

2017-08-01 08:39:29 -04:00

nfs

NFS client bugfixes for Linux 4.14

2017-09-14 20:04:32 -07:00

nfs_common

netns: make struct pernet_operations::id unsigned int

2016-11-18 10:59:15 -05:00

nfsd

More RDMA work and some op-structure constification from Chuck Lever,

2017-09-09 13:31:49 -07:00

nilfs2

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

nls

…

notify

fsnotify: make dnotify_fsnotify_ops const

2017-08-30 16:02:48 +02:00

ntfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

ocfs2

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

omfs

omfs: Implement show_options

2017-07-06 03:31:46 -04:00

openpromfs

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

orangefs

orangefs: Adjust three checks for null pointers

2017-09-14 14:58:31 -04:00

overlayfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

proc

sched/debug: Add explicit TASK_PARKED printing

2017-09-29 11:02:57 +02:00

pstore

Revert "pstore: Honor dmesg_restrict sysctl on dmesg dumps"

2017-08-17 16:29:19 -07:00

qnx4

…

qnx6

…

quota

quota: Fix quota corruption with generic/232 test

2017-09-27 11:33:47 +02:00

ramfs

mm: make pagevec_lookup() update index

2017-09-06 17:27:26 -07:00

reiserfs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

romfs

romfs: use different way to generate fsid for BLOCK or MTD

2017-01-24 16:26:14 -08:00

squashfs

squashfs: Add zstd support

2017-09-08 19:33:25 -07:00

sysfs

sysfs: be careful of error returns from ops->show()

2017-04-08 17:33:32 +02:00

sysv

VFS: Convert sb->s_flags & MS_RDONLY to sb_rdonly(sb)

2017-07-17 08:45:34 +01:00

tracefs

VFS: Don't use save/replace_mount_options if not using generic_show_options

2017-07-06 03:31:46 -04:00

ubifs

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

udf

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

ufs

VFS: Convert sb->s_flags & MS_RDONLY to sb_rdonly(sb)

2017-07-17 08:45:34 +01:00

xfs

xfs: revert "xfs: factor rmap btree size into the indlen calculations"

2017-09-26 10:55:20 -07:00

aio.c

Merge branch 'work.read_write' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 19:29:55 -07:00

anon_inodes.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

attr.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>

2017-03-02 08:42:29 +01:00

bad_inode.c

statx: Add a system call to make enhanced file info available

2017-03-02 20:51:15 -05:00

binfmt_aout.c

fs: fix kernel_read prototype

2017-09-04 19:05:15 -04:00

binfmt_elf_fdpic.c

Merge branch 'work.set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:13:32 -07:00

binfmt_elf.c

Merge branch 'work.set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:13:32 -07:00

binfmt_em86.c

…

binfmt_flat.c

Merge branch 'work.set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:13:32 -07:00

binfmt_misc.c

exec: binfmt_misc: shift filp_close(interp_file) from kill_node() to bm_evict_inode()

2017-10-03 17:54:25 -07:00

binfmt_script.c

exec: load_script: kill the onstack interp[BINPRM_BUF_SIZE] array

2017-10-03 17:54:25 -07:00

block_dev.c

Merge branch 'work.read_write' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 19:29:55 -07:00

buffer.c

Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block

2017-09-07 11:59:42 -07:00

char_dev.c

char_dev: order /proc/devices by major number

2017-07-17 15:28:50 +02:00

compat_binfmt_elf.c

fs/binfmt: Convert obsolete cputime type to nsecs

2017-02-01 09:13:51 +01:00

compat_ioctl.c

media: get rid of removed DMX_GET_CAPS and DMX_SET_SOURCE leftovers

2017-09-05 08:25:07 -04:00

compat.c

fs/compat.c: trim unused includes

2017-04-17 12:52:27 -04:00

coredump.c

mm: treewide: remove GFP_TEMPORARY allocation flag

2017-09-13 18:53:16 -07:00

dax.c

- Some request-based DM core and DM multipath fixes and cleanups

2017-09-14 13:43:16 -07:00

dcache.c

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

dcookies.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

direct-io.c

fs: Fix page cache inconsistency when mixing buffered and AIO DIO

2017-09-25 08:56:05 -06:00

drop_caches.c

…

eventfd.c

There has been a fair amount of activity in the docs tree this time

2017-07-03 21:13:25 -07:00

eventpoll.c

fs/epoll: use faster rb_first_cached()

2017-09-08 18:26:49 -07:00

exec.c

exec: load_script: kill the onstack interp[BINPRM_BUF_SIZE] array

2017-10-03 17:54:25 -07:00

fcntl.c

fcntl: Don't set si_code to SI_SIGIO when sig == SIGPOLL

2017-09-18 22:51:14 -05:00

fhandle.c

fhandle: move compat syscalls from compat.c

2017-04-17 12:52:26 -04:00

file_table.c

fput: Don't reinvent the wheel but use existing llist API

2017-08-28 00:50:23 -04:00

file.c

fs/file.c: replace alloc_fdmem() with kvmalloc() alternative

2017-07-06 16:24:30 -07:00

filesystems.c

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-15 12:00:42 -07:00

fs_pin.c

sched/wait: Disambiguate wq_entry->task_list and wq_head->task_list naming

2017-06-20 12:19:14 +02:00

fs_struct.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>

2017-03-02 08:42:35 +01:00

fs-writeback.c

writeback: rework wb_[dec|inc]_stat family of functions

2017-07-12 16:26:05 -07:00

inode.c

Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs

2017-09-13 09:11:44 -07:00

internal.h

Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs

2017-09-13 09:11:44 -07:00

ioctl.c

sched/headers: Prepare for the reduction of <linux/sched.h>'s signal API dependency

2017-03-02 08:42:37 +01:00

iomap.c

Changes since last update:

2017-09-28 13:27:23 -07:00

Kconfig

fs/Kconfig: kill CONFIG_PERCPU_RWSEM some more

2017-07-12 16:26:00 -07:00

Kconfig.binfmt

docs: fix locations of several documents that got moved

2016-10-24 08:12:35 -02:00

libfs.c

fs: convert __generic_file_fsync to use errseq_t based reporting

2017-07-06 07:02:29 -04:00

locks.c

locks: restore a warn for leaked locks on close

2017-07-21 13:57:31 -04:00

Makefile

logfs: remove from tree

2016-12-14 23:48:11 -05:00

mbcache.c

ext4: xattr inode deduplication

2017-06-22 11:44:55 -04:00

mount.h

Now that IPC and other changes have landed, enable manual markings for

2017-07-19 08:55:18 -07:00

mpage.c

block: replace bi_bdev with a gendisk pointer and partitions index

2017-08-23 12:49:55 -06:00

namei.c

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

namespace.c

Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 20:01:41 -07:00

no-block.c

…

nsfs.c

VFS: Provide empty name qstr

2017-07-06 03:27:09 -04:00

open.c

ovl: don't allow writing ioctl on lower layer

2017-09-05 12:53:12 +02:00

pipe.c

VFS: Provide empty name qstr

2017-07-06 03:27:09 -04:00

pnode.c

mnt: Make propagate_umount less slow for overlapping mount propagation trees

2017-05-23 08:41:17 -05:00

pnode.h

mnt: Tuck mounts under others instead of creating shadow/side mounts.

2017-02-04 00:01:06 +13:00

posix_acl.c

sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>

2017-03-02 08:42:31 +01:00

proc_namespace.c

VFS: Convert sb->s_flags & MS_RDONLY to sb_rdonly(sb)

2017-07-17 08:45:34 +01:00

read_write.c

vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets

2017-09-26 13:46:06 -07:00

readdir.c

readdir: move compat syscalls from compat.c

2017-04-17 12:52:24 -04:00

select.c

fs/select: Fix memory corruption in compat_get_fd_set()

2017-08-28 16:09:19 -07:00

seq_file.c

mm: introduce kv[mz]alloc helpers

2017-05-08 17:15:12 -07:00

signalfd.c

signal: Remove kernel interal si_code magic

2017-07-24 14:30:28 -05:00

splice.c

fs: move kernel_write to fs/read_write.c

2017-09-04 19:05:15 -04:00

stack.c

…

stat.c

fs: Provide __inode_get_bytes()

2017-08-17 22:06:03 +02:00

statfs.c

Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-07-08 10:50:54 -07:00

super.c

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

sync.c

Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-09-14 18:54:01 -07:00

timerfd.c

timerfd: Use get_itimerspec64() and put_itimerspec64()

2017-06-30 04:14:38 -04:00

userfaultfd.c

userfaultfd: non-cooperative: fix fork use after free

2017-10-03 17:54:25 -07:00

utimes.c

utimes: Make utimes y2038 safe

2017-09-03 20:24:30 -04:00

xattr.c

Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs

2017-09-13 09:11:44 -07:00