The patch titled
Subject: fs/binfmt_elf.c: fix GPF when dereferencing invalid interpreter
has been added to the -mm tree. Its filename is
elf-free-pt_interp-filename-asap-fix.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/elf-free-pt_interp-filename-asap-fix.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/elf-free-pt_interp-filename-asap-fix.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Nikitas Angelinas <nikitas.angelinas@xxxxxxxxx>
Subject: fs/binfmt_elf.c: fix GPF when dereferencing invalid interpreter
Syzkaller found an issue where an invalid interpreter pointer is
dereferenced on the failure path in
load_elf_binary()->allow_write_access(). Fix this by jumping to a
different label in the cleanup path.
Link: http://lkml.kernel.org/r/20190330140032.GA1527@vostro
Fixes: 44e63c4a0263 ("fs/binfmt_elf.c: free PT_INTERP filename ASAP")
Signed-off-by: Nikitas Angelinas <nikitas.angelinas@xxxxxxxxx>
Reported-by: syzbot+0d1fcd7268b21baced4a@xxxxxxxxxxxxxxxxxxxxxxxxx
Reviewed-by: Mukesh Ojha <mojha@xxxxxxxxxxxxxx>
Cc: Alexey Dobriyan <adobriyan@xxxxxxxxx>
Cc: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
fs/binfmt_elf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/binfmt_elf.c~elf-free-pt_interp-filename-asap-fix
+++ a/fs/binfmt_elf.c
@@ -777,7 +777,7 @@ static int load_elf_binary(struct linux_
kfree(elf_interpreter);
retval = PTR_ERR(interpreter);
if (IS_ERR(interpreter))
- goto out_free_dentry;
+ goto out_free_ph;
/*
* If the binary is not readable then enforce
_
Patches currently in -mm which might be from nikitas.angelinas@xxxxxxxxx are
elf-free-pt_interp-filename-asap-fix.patch
