Commit 63e46b95 authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds

exec: move the final allow_write_access/fput into free_bprm()

Both success/failure paths cleanup bprm->file, we can move this
code into free_bprm() to simlify and cleanup this logic.
Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
Acked-by: default avatarKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 9e00cdb0
...@@ -1138,9 +1138,7 @@ void setup_new_exec(struct linux_binprm * bprm) ...@@ -1138,9 +1138,7 @@ void setup_new_exec(struct linux_binprm * bprm)
/* An exec changes our domain. We are no longer part of the thread /* An exec changes our domain. We are no longer part of the thread
group */ group */
current->self_exec_id++; current->self_exec_id++;
flush_signal_handlers(current, 0); flush_signal_handlers(current, 0);
do_close_on_exec(current->files); do_close_on_exec(current->files);
} }
...@@ -1172,6 +1170,10 @@ void free_bprm(struct linux_binprm *bprm) ...@@ -1172,6 +1170,10 @@ void free_bprm(struct linux_binprm *bprm)
mutex_unlock(&current->signal->cred_guard_mutex); mutex_unlock(&current->signal->cred_guard_mutex);
abort_creds(bprm->cred); abort_creds(bprm->cred);
} }
if (bprm->file) {
allow_write_access(bprm->file);
fput(bprm->file);
}
/* If a binfmt changed the interp, free it. */ /* If a binfmt changed the interp, free it. */
if (bprm->interp != bprm->filename) if (bprm->interp != bprm->filename)
kfree(bprm->interp); kfree(bprm->interp);
...@@ -1424,12 +1426,6 @@ static int exec_binprm(struct linux_binprm *bprm) ...@@ -1424,12 +1426,6 @@ static int exec_binprm(struct linux_binprm *bprm)
ptrace_event(PTRACE_EVENT_EXEC, old_vpid); ptrace_event(PTRACE_EVENT_EXEC, old_vpid);
current->did_exec = 1; current->did_exec = 1;
proc_exec_connector(current); proc_exec_connector(current);
if (bprm->file) {
allow_write_access(bprm->file);
fput(bprm->file);
bprm->file = NULL; /* to catch use-after-free */
}
} }
return ret; return ret;
...@@ -1492,7 +1488,7 @@ static int do_execve_common(const char *filename, ...@@ -1492,7 +1488,7 @@ static int do_execve_common(const char *filename,
retval = bprm_mm_init(bprm); retval = bprm_mm_init(bprm);
if (retval) if (retval)
goto out_file; goto out_unmark;
bprm->argc = count(argv, MAX_ARG_STRINGS); bprm->argc = count(argv, MAX_ARG_STRINGS);
if ((retval = bprm->argc) < 0) if ((retval = bprm->argc) < 0)
...@@ -1539,12 +1535,6 @@ static int do_execve_common(const char *filename, ...@@ -1539,12 +1535,6 @@ static int do_execve_common(const char *filename,
mmput(bprm->mm); mmput(bprm->mm);
} }
out_file:
if (bprm->file) {
allow_write_access(bprm->file);
fput(bprm->file);
}
out_unmark: out_unmark:
current->fs->in_exec = 0; current->fs->in_exec = 0;
current->in_execve = 0; current->in_execve = 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment