Commit 8c652f96 authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds
Browse files

do_execve() must not clear fs->in_exec if it was set by another thread 



If do_execve() fails after check_unsafe_exec(), it clears fs->in_exec
unconditionally. This is wrong if we race with our sub-thread which
also does do_execve:

	Two threads T1 and T2 and another process P, all share the same
	->fs.

	T1 starts do_execve(BAD_FILE). It calls check_unsafe_exec(), since
	->fs is shared, we set LSM_UNSAFE but not ->in_exec.

	P exits and decrements fs->users.

	T2 starts do_execve(), calls check_unsafe_exec(), now ->fs is not
	shared, we set fs->in_exec.

	T1 continues, open_exec(BAD_FILE) fails, we clear ->in_exec and
	return to the user-space.

	T1 does clone(CLONE_FS /* without CLONE_THREAD */).

	T2 continues without LSM_UNSAFE_SHARE while ->fs is shared with
	another process.

Change check_unsafe_exec() to return res = 1 if we set ->in_exec, and change
do_execve() to clear ->in_exec depending on res.

When do_execve() suceeds, it is safe to clear ->in_exec unconditionally.
It can be set only if we don't share ->fs with another process, and since
we already killed all sub-threads either ->in_exec == 0 or we are the
only user of this ->fs.

Also, we do not need fs->lock to clear fs->in_exec.

Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
Acked-by: default avatarRoland McGrath <roland@redhat.com>
Acked-by: default avatarHugh Dickins <hugh@veritas.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 09106974

fs/compat.c

+5 −6
Original line number Diff line number Diff line
@@ -1476,6 +1476,7 @@ int compat_do_execve(char * filename, 
	struct linux_binprm *bprm;

	struct file *file;

	struct files_struct *displaced;

	bool clear_in_exec;

	int retval;



	retval = unshare_files(&displaced);
@@ -1498,8 +1499,9 @@ int compat_do_execve(char * filename, 
		goto out_unlock;



	retval = check_unsafe_exec(bprm);

	if (retval)

	if (retval < 0)

		goto out_unlock;

	clear_in_exec = retval;



	file = open_exec(filename);

	retval = PTR_ERR(file);
@@ -1546,9 +1548,7 @@ int compat_do_execve(char * filename, 
		goto out;



	/* execve succeeded */

	write_lock(&current->fs->lock);

	current->fs->in_exec = 0;

	write_unlock(&current->fs->lock);

	current->in_execve = 0;

	mutex_unlock(&current->cred_exec_mutex);

	acct_update_integrals(current);
@@ -1568,9 +1568,8 @@ out_file: 
	}



out_unmark:

	write_lock(&current->fs->lock);

	if (clear_in_exec)

		current->fs->in_exec = 0;

	write_unlock(&current->fs->lock);



out_unlock:

	current->in_execve = 0;

fs/exec.c

+10 −9
Original line number Diff line number Diff line
@@ -1077,9 +1077,11 @@ int check_unsafe_exec(struct linux_binprm *bprm) 
	if (p->fs->users > n_fs) {

		bprm->unsafe |= LSM_UNSAFE_SHARE;

	} else {

		if (p->fs->in_exec)

		res = -EAGAIN;

		if (!p->fs->in_exec) {

			p->fs->in_exec = 1;

			res = 1;

		}

	}



	unlock_task_sighand(p, &flags);
@@ -1284,6 +1286,7 @@ int do_execve(char * filename, 
	struct linux_binprm *bprm;

	struct file *file;

	struct files_struct *displaced;

	bool clear_in_exec;

	int retval;



	retval = unshare_files(&displaced);
@@ -1306,8 +1309,9 @@ int do_execve(char * filename, 
		goto out_unlock;



	retval = check_unsafe_exec(bprm);

	if (retval)

	if (retval < 0)

		goto out_unlock;

	clear_in_exec = retval;



	file = open_exec(filename);

	retval = PTR_ERR(file);
@@ -1355,9 +1359,7 @@ int do_execve(char * filename, 
		goto out;



	/* execve succeeded */

	write_lock(&current->fs->lock);

	current->fs->in_exec = 0;

	write_unlock(&current->fs->lock);

	current->in_execve = 0;

	mutex_unlock(&current->cred_exec_mutex);

	acct_update_integrals(current);
@@ -1377,9 +1379,8 @@ out_file: 
	}



out_unmark:

	write_lock(&current->fs->lock);

	if (clear_in_exec)

		current->fs->in_exec = 0;

	write_unlock(&current->fs->lock);



out_unlock:

	current->in_execve = 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE