The patch titled
Subject: exec: Fix min/max typo in stack space calculation
has been added to the -mm tree. Its filename is
exec-force-single-empty-string-when-argv-is-empty-fix.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/exec-force-single-empty-string-when-argv-is-empty-fix.patch
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/exec-force-single-empty-string-when-argv-is-empty-fix.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Kees Cook <keescook@xxxxxxxxxxxx>
Subject: exec: Fix min/max typo in stack space calculation
When handling the argc == 0 case, the stack space calculation should be
using max() not min().
Link: https://lkml.kernel.org/r/20220201190700.3147041-1-keescook@xxxxxxxxxxxx
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Michael Kerrisk <mtk.manpages@xxxxxxxxx>
Cc: Ariadne Conill <ariadne@xxxxxxxxxxxxxxxx>
Cc: Andy Lutomirski <luto@xxxxxxxxxx>
Cc: Matthew Wilcox <willy@xxxxxxxxxxxxx>
Cc: Christian Brauner <brauner@xxxxxxxxxx>
Cc: Rich Felker <dalias@xxxxxxxx>
Cc: Eric Biederman <ebiederm@xxxxxxxxxxxx>
Cc: Alexander Viro <viro@xxxxxxxxxxxxxxxxxx>
Cc: Shuah Khan <shuah@xxxxxxxxxx>
Cc: Yang Yingliang <yangyingliang@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
fs/exec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/exec.c~exec-force-single-empty-string-when-argv-is-empty-fix
+++ a/fs/exec.c
@@ -502,7 +502,7 @@ static int bprm_stack_limits(struct linu
* argc can never be 0, to keep them from walking envp by accident.
* See do_execveat_common().
*/
- ptr_size = (min(bprm->argc, 1) + bprm->envc) * sizeof(void *);
+ ptr_size = (max(bprm->argc, 1) + bprm->envc) * sizeof(void *);
if (limit <= ptr_size)
return -E2BIG;
limit -= ptr_size;
_
Patches currently in -mm which might be from keescook@xxxxxxxxxxxx are
kconfigdebug-make-debug_info-selectable-from-a-choice.patch
kconfigdebug-make-debug_info-selectable-from-a-choice-fix.patch
exec-force-single-empty-string-when-argv-is-empty.patch
exec-force-single-empty-string-when-argv-is-empty-fix.patch
selftests-exec-test-for-empty-string-on-null-argv.patch
selftests-kselftest-framework-provide-finished-helper.patch
