From: Zhihao Cheng <chengzhihao1@huawei.com>
To: <keescook@chromium.org>, <viro@zeniv.linux.org.uk>,
<akpm@linux-foundation.org>
Cc: <linux-mm@kvack.org>, <linux-fsdevel@vger.kernel.org>,
<linux-kernel@vger.kernel.org>, <chengzhihao1@huawei.com>,
<yukuai3@huawei.com>
Subject: [PATCH -next] exec: Remove redundant check in do_open_execat/uselib
Date: Wed, 18 May 2022 16:12:27 +0800 [thread overview]
Message-ID: <20220518081227.1278192-1-chengzhihao1@huawei.com> (raw)
There is a false positive WARNON happening in execve(2)/uselib(2)
syscalls with concurrent noexec-remount.
execveat remount
do_open_execat(path/bin)
do_filp_open
path_openat
do_open
may_open
path_noexec() // PASS
remount(path->mnt, MS_NOEXEC)
WARNON(path_noexec(&file->f_path)) // path_noexec() checks fail
Since may_open() has already checked the same conditions, fix it by
removing 'S_ISREG' and 'path_noexec' check in do_open_execat()/uselib(2).
Fixes: 0fd338b2d2cdf8 ("exec: move path_noexec() check earlier")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
---
fs/exec.c | 22 +---------------------
1 file changed, 1 insertion(+), 21 deletions(-)
diff --git a/fs/exec.c b/fs/exec.c
index e3e55d5e0be1..0f8ea7e9e03c 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -141,16 +141,6 @@ SYSCALL_DEFINE1(uselib, const char __user *, library)
if (IS_ERR(file))
goto out;
- /*
- * may_open() has already checked for this, so it should be
- * impossible to trip now. But we need to be extra cautious
- * and check again at the very end too.
- */
- error = -EACCES;
- if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) ||
- path_noexec(&file->f_path)))
- goto exit;
-
fsnotify_open(file);
error = -ENOEXEC;
@@ -169,7 +159,7 @@ SYSCALL_DEFINE1(uselib, const char __user *, library)
break;
}
read_unlock(&binfmt_lock);
-exit:
+
fput(file);
out:
return error;
@@ -919,16 +909,6 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags)
if (IS_ERR(file))
goto out;
- /*
- * may_open() has already checked for this, so it should be
- * impossible to trip now. But we need to be extra cautious
- * and check again at the very end too.
- */
- err = -EACCES;
- if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) ||
- path_noexec(&file->f_path)))
- goto exit;
-
err = deny_write_access(file);
if (err)
goto exit;
--
2.31.1
next reply other threads:[~2022-05-18 7:59 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-18 8:12 Zhihao Cheng [this message]
2022-05-18 17:46 ` Andrew Morton
2022-05-18 19:17 ` Kees Cook
2022-05-18 19:27 ` Andrew Morton
2022-05-19 1:51 ` Zhihao Cheng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220518081227.1278192-1-chengzhihao1@huawei.com \
--to=chengzhihao1@huawei.com \
--cc=akpm@linux-foundation.org \
--cc=keescook@chromium.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=viro@zeniv.linux.org.uk \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox