The patch titled fs/exec.c: fix wrong return value of prepare_binprm() has been added to the -mm tree. Its filename is fs-execc-fix-wrong-return-value-of-prepare_binprm.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: fs/exec.c: fix wrong return value of prepare_binprm() From: WANG Cong <xiyou.wangcong@xxxxxxxxx> All prepare_binprm()'s callers assume that prepare_binprm() fails when it returns negative. However, prepare_binprm() most probably returns the return value of kernel_read(), which may return positive on failure! Thus this should be fixed. Signed-off-by: WANG Cong <wangcong@xxxxxxxxx> Cc: Alexander Viro <viro@xxxxxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/exec.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff -puN fs/exec.c~fs-execc-fix-wrong-return-value-of-prepare_binprm fs/exec.c --- a/fs/exec.c~fs-execc-fix-wrong-return-value-of-prepare_binprm +++ a/fs/exec.c @@ -1064,10 +1064,14 @@ int prepare_binprm(struct linux_binprm * if (retval) return retval; - memset(bprm->buf,0,BINPRM_BUF_SIZE); - return kernel_read(bprm->file,0,bprm->buf,BINPRM_BUF_SIZE); + memset(bprm->buf, 0, BINPRM_BUF_SIZE); + retval = kernel_read(bprm->file, 0, bprm->buf, BINPRM_BUF_SIZE); + if (retval < 0) + return retval; + if (retval != BINPRM_BUF_SIZE && retval != inode->i_size) + return -EIO; + return 0; } - EXPORT_SYMBOL(prepare_binprm); static int unsafe_exec(struct task_struct *p) _ Patches currently in -mm which might be from xiyou.wangcong@xxxxxxxxx are uml-fix-inconsistence-due-to-tty_operation-change.patch uml-redo-host-capability-detection-and-disabling.patch uml-tidy-stub-management-code.patch uml-style-fixes.patch uml-hppfs-fixes.patch uml-move-hppfs_kernc-to-hppfsc.patch uml-tidy-ptrace-interface.patch uml-fix-errno-return.patch uml-fix-build-when-slob-is-enabled.patch uml-remove-unused-header.patch uml-fix-bad-ntp-interaction-with-clock.patch uml-use-__spin_lock_unlocked.patch uml-fix-config_raw-dependencies.patch uml-use-div_round_up.patch uml-use-page_size-in-linker-scripts.patch uml-physical-memory-shouldnt-include-initial-stack.patch fs-binfmt_elfc-fix-a-wrong-free.patch cpumask-remove-bitmap_scnprintf_len-and-cpumask_scnprintf_len.patch arch-um-kernel-irqc-clean-up-some-functions.patch arch-um-kernel-memc-remove-arch_validate.patch uml-make-several-more-things-static.patch fs-execc-export-free_arg_pages.patch fs-execc-fix-resource-leaks-and-wrong-gotos.patch fs-compatc-fix-resource-leaks-and-wrong-gotos.patch fs-binfmt_scriptc-fix-resource-leaks.patch fs-binfmt_em86c-fix-resource-leaks.patch fs-binfmt_miscc-fix-resource-leaks.patch fs-execc-fix-wrong-return-value-of-prepare_binprm.patch fs-binfmt_elfc-fix-wrong-return-values.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html