execve(2) bug with FIFOs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

Linux execve(2) appears to have a bug: The execve(2) of a FIFO file with execute permission results in the kernel opening the named pipe. Since there are no writers and this is a blocking call, the syscall goes to sleep waiting for writer(s) on the file.

Stack trace:
 #0 [ffff880b978bfb58] schedule at ffffffff814dad09
 #1 [ffff880b978bfc20] pipe_wait at ffffffff8117c1cb
 #2 [ffff880b978bfc70] fifo_open at ffffffff8118885c
 #3 [ffff880b978bfcb0] __dentry_open at ffffffff8116fb7a
 #4 [ffff880b978bfd10] nameidata_to_filp at ffffffff8116fee4
 #5 [ffff880b978bfd30] do_filp_open at ffffffff81182b40
 #6 [ffff880b978bfe80] open_exec at ffffffff8117b033
 #7 [ffff880b978bfeb0] do_execve at ffffffff8117b1ef
 #8 [ffff880b978bff20] sys_execve at ffffffff810095ca
 #9 [ffff880b978bff50] stub_execve at ffffffff8100b5ca 

The issue appears to be that in open_exec(), before we've had a chance to verify that it's a regular file, the do_filp_open() ends up in pipe_wait().

Other OSes return EACCES as expected in the same situation.

Respectfully,

Kuthonuzo

--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]
  Powered by Linux