The patch titled exec: fix stack excutability without PT_GNU_STACK has been added to the -mm tree. Its filename is exec-fix-stack-excutability-without-pt_gnu_stack.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: exec: fix stack excutability without PT_GNU_STACK From: Hugh Dickins <hugh@xxxxxxxxxxx> http://bugzilla.kernel.org/show_bug.cgi?id=11063 points out that on some architectures (e.g. x86_32) exec'ing an ELF without a PT_GNU_STACK program header should default to an executable stack; but this got broken by the unlimited argv feature because stack vma is now created before the right personality has been established: so breaking old binaries using nested function trampolines. Therefore re-evaluate VM_STACK_FLAGS in setup_arg_pages, where stack vm_flags used to be set, before the mprotect_fixup. Checking through our existing VM_flags, none would have changed since insert_vm_struct: so this seems safer than finding a way through the personality labyrinth. Reviewed-by: <pageexec@xxxxxxxxxxx> Signed-off-by: Hugh Dickins <hugh@xxxxxxxxxxx> Cc: <stable@xxxxxxxxxx> Cc: Ollie Wild <aaw@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN fs/exec.c~exec-fix-stack-excutability-without-pt_gnu_stack fs/exec.c --- a/fs/exec.c~exec-fix-stack-excutability-without-pt_gnu_stack +++ a/fs/exec.c @@ -610,7 +610,7 @@ int setup_arg_pages(struct linux_binprm bprm->exec -= stack_shift; down_write(&mm->mmap_sem); - vm_flags = vma->vm_flags; + vm_flags = VM_STACK_FLAGS; /* * Adjust stack execute permissions; explicitly enable for _ Patches currently in -mm which might be from hugh@xxxxxxxxxxx are linux-next.patch git-unionfs.patch unionfs-fix-memory-leak.patch fsstack-fsstack_copy_inode_size-locking.patch mm-remove-nopfn-fix.patch access_process_vm-device-memory-infrastructure.patch use-generic_access_phys-for-dev-mem-mappings.patch use-generic_access_phys-for-dev-mem-mappings-fix.patch use-generic_access_phys-for-pci-mmap-on-x86.patch powerpc-ioremap_prot.patch spufs-use-the-new-vm_ops-access.patch spufs-use-the-new-vm_ops-access-fix.patch mm-remove-double-indirection-on-tlb-parameter-to-free_pgd_range-co.patch hugetlb-move-hugetlb_acct_memory.patch hugetlb-reserve-huge-pages-for-reliable-map_private-hugetlbfs-mappings-until-fork.patch hugetlb-guarantee-that-cow-faults-for-a-process-that-called-mmapmap_private-on-hugetlbfs-will-succeed.patch hugetlb-guarantee-that-cow-faults-for-a-process-that-called-mmapmap_private-on-hugetlbfs-will-succeed-fix.patch hugetlb-guarantee-that-cow-faults-for-a-process-that-called-mmapmap_private-on-hugetlbfs-will-succeed-build-fix.patch huge-page-private-reservation-review-cleanups.patch huge-page-private-reservation-review-cleanups-fix.patch mm-record-map_noreserve-status-on-vmas-and-fix-small-page-mprotect-reservations.patch hugetlb-move-reservation-region-support-earlier.patch hugetlb-allow-huge-page-mappings-to-be-created-without-reservations.patch hugetlb-allow-huge-page-mappings-to-be-created-without-reservations-cleanups.patch hugetlb-reservations-fix-hugetlb-map_private-reservations-across-vma-splits-v2.patch vma-page-offset-has-no-callees-drop-it.patch generic_file_aio_read-cleanups.patch tmpfs-support-aio.patch hugetlb-fix-race-when-reading-proc-meminfo.patch mmu-notifiers-add-list_del_init_rcu.patch mmu-notifiers-add-mm_take_all_locks-operation.patch mmu-notifiers-add-mm_take_all_locks-operation-checkpatch-fixes.patch mmu-notifier-core.patch mmu-notifier-core-fix.patch mmu-notifier-core-fix-2.patch security-remove-unused-forwards.patch exec-remove-some-includes.patch exec-remove-some-includes-fix.patch memcg-better-migration-handling.patch memcg-remove-refcnt-from-page_cgroup.patch memcg-remove-refcnt-from-page_cgroup-fix.patch memcg-remove-refcnt-from-page_cgroup-fix-2.patch memcg-remove-refcnt-from-page_cgroup-fix-memcg-fix-mem_cgroup_end_migration-race.patch memcg-remove-refcnt-from-page_cgroup-memcg-fix-shmem_unuse_inode-charging.patch memcg-handle-swap-cache.patch memcg-handle-swap-cache-fix.patch memcg-handle-swap-cache-fix-shmem-page-migration-incorrectness-on-memcgroup.patch memcg-helper-function-for-relcaim-from-shmem.patch memcg-helper-function-for-relcaim-from-shmem-memcg-shmem_getpage-release-page-sooner.patch memcg-helper-function-for-relcaim-from-shmem-memcg-mem_cgroup_shrink_usage-css_put.patch memcg-add-hints-for-branch.patch memcg-remove-a-redundant-check.patch memcg-clean-up-checking-of-the-disabled-flag-memcg-further-checking-of-disabled-flag.patch memrlimit-cgroup-mm-owner-callback-changes-to-add-task-info-memrlimit-fix-mmap_sem-deadlock.patch memrlimit-cgroup-mm-owner-callback-changes-to-add-task-info-memrlimit-fix-sleep-inside-sleeplock-in-mm_update_next_owner.patch memrlimit-add-memrlimit-controller-accounting-and-control-memrlimit-improve-fork-and-error-handling.patch memrlimit-improve-error-handling.patch memrlimit-improve-error-handling-update.patch memrlimit-handle-attach_task-failure-add-can_attach-callback.patch memrlimit-handle-attach_task-failure-add-can_attach-callback-update.patch x86-implement-pte_special-fix.patch mm-readahead-scan-lockless.patch radix-tree-add-gang_lookup_slot-gang_lookup_slot_tag.patch mm-speculative-page-references.patch mm-speculative-page-references-fix.patch mm-speculative-page-references-fix-fix.patch mm-lockless-pagecache.patch mm-spinlock-tree_lock.patch powerpc-implement-pte_special.patch define-page_file_cache-function-fix-splitlru-shmem_getpage-setpageswapbacked-sooner.patch vmscan-split-lru-lists-into-anon-file-sets-splitlru-memcg-swapbacked-pages-active.patch vmscan-split-lru-lists-into-anon-file-sets-splitlru-bdi_cap_swap_backed.patch mlock-mlocked-pages-are-unevictable-fix-4.patch vmstat-mlocked-pages-statistics-fix-incorrect-mlocked-field-of-proc-meminfo.patch prio_tree-debugging-patch.patch exec-fix-stack-excutability-without-pt_gnu_stack.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html