From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43289D36108 for ; Tue, 5 Nov 2024 19:07:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id BEB1C6B0089; Tue, 5 Nov 2024 14:07:20 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id B9B726B008A; Tue, 5 Nov 2024 14:07:20 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A3B926B0098; Tue, 5 Nov 2024 14:07:20 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 85E396B0089 for ; Tue, 5 Nov 2024 14:07:20 -0500 (EST) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id DF14E14053D for ; Tue, 5 Nov 2024 19:07:18 +0000 (UTC) X-FDA: 82752972876.03.C18D54B Received: from fhigh-a8-smtp.messagingengine.com (fhigh-a8-smtp.messagingengine.com [103.168.172.159]) by imf08.hostedemail.com (Postfix) with ESMTP id AA90916003A for ; Tue, 5 Nov 2024 19:06:47 +0000 (UTC) Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=tycho.pizza header.s=fm2 header.b=XjUd9H0H; dkim=pass header.d=messagingengine.com header.s=fm3 header.b=hutAm7G1; dmarc=none; spf=pass (imf08.hostedemail.com: domain of tycho@tycho.pizza designates 103.168.172.159 as permitted sender) smtp.mailfrom=tycho@tycho.pizza ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1730833571; a=rsa-sha256; cv=none; b=1K8OzRivvwDcn1KA/gVgadyo50iuCU9A0/heic0FUmxY7IPdhqeuJ3188y6TPqIiHJUWvI fBxCZbE40RKCBuCmonNaEFjtE9U88fOLffwDfu71nxzIjxYncWtzYHNLIQIRFCF6UK+gC7 Vbm70Roe3sBpzFM8JT82i/qlpLifnEA= ARC-Authentication-Results: i=1; imf08.hostedemail.com; dkim=pass header.d=tycho.pizza header.s=fm2 header.b=XjUd9H0H; dkim=pass header.d=messagingengine.com header.s=fm3 header.b=hutAm7G1; dmarc=none; spf=pass (imf08.hostedemail.com: domain of tycho@tycho.pizza designates 103.168.172.159 as permitted sender) smtp.mailfrom=tycho@tycho.pizza ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1730833571; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Q9TQIfEYCuOxbtDhygMHBbUHqm0TEXM3xROT8eAMRoI=; b=OiqBzMgHtXP+M08v1d4b4AJKuZjtKFLuHBVRBtQKcoCDREIwhAIu7+HX8Ux65A/bGnUZ1j oymsbCvUlQOK0FK3e2sgPZlDrzLpBxBT2W35zAdjZEKQw1BklDXwdy2wZQv/bOsEMh7W/b wLWjzFfN1U1FRjKepJUT9k9kzU1xigo= Received: from phl-compute-04.internal (phl-compute-04.phl.internal [10.202.2.44]) by mailfhigh.phl.internal (Postfix) with ESMTP id 2F811114016F; Tue, 5 Nov 2024 14:07:09 -0500 (EST) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-04.internal (MEProxy); Tue, 05 Nov 2024 14:07:09 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tycho.pizza; h= cc:cc:content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm2; t=1730833629; x=1730920029; bh=Q9TQIfEYCu OxbtDhygMHBbUHqm0TEXM3xROT8eAMRoI=; b=XjUd9H0Hjyx3bxW0VQOY0EjHUX NeYQy4WK+v6uMfTssEpxNlYur2iT12vAWeDBDvOyI4cscfX1WLRWSf/woYBIS+bt AX75JrQwZhjSeiO7rysjv1RX//aKU2PVpIcEZkCrZXzKA1Hntz3mPuUDwDE6uwfr bkLtM89Gul1rZ6DvyCpzh7ElJ2TRh0uhIA3if0lYbXxT8eHUgvjkgp2BxcvmEWQT qgZpvvhh/B6eff7+WTJFb+tVxe8blWJuxgb+YicjsvTsJjhsIF+N4VaJHHJvNrxE 7KApXO1RHhCFK3X6WEL3q7hxZrDmbh8VZPSPDNHJS+IRkTZYQJLrK71YtTOA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t= 1730833629; x=1730920029; bh=Q9TQIfEYCuOxbtDhygMHBbUHqm0TEXM3xRO T8eAMRoI=; b=hutAm7G1P9CXmRmKK8aCmzFigdJ+MMn/u0E/EnMaSvaISC6tMWe y8PGLb4eWZ66bKigepNC4cdlDJoVTQjcujhIlut9gUSmBZAPSR9xhe1r1GsDMJjk JsBxIB0hULRGlcAHbLpmjWdC0025RNIuk8Zy9N1XuizXXCpv66AxfbntBshPG1L3 iFvpfaELpRrzMoxrovYm2W/rr/tVpmlFMlJLL0HEf/efDaQt+6kMBoIyVRqHJqEA RTKx/snqbGy2nQqFd14eWTjN0HgRPaxLul0cg8PnycngBJ6+/T9Y8C6pO0pcJ8xN LmKh2pYnZg6bYiFxpIpIjDxNnNqwAIsMcqw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefuddrtddtgdelvdcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpggftfghnshhusghstghrihgsvgdpuffr tefokffrpgfnqfghnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnth hsucdlqddutddtmdenucfjughrpeffhffvvefukfhfgggtuggjsehttdertddttddvnecu hfhrohhmpefvhigthhhoucetnhguvghrshgvnhcuoehthigthhhosehthigthhhordhpih iiiigrqeenucggtffrrghtthgvrhhnpeelveduteeghfehkeeukefhudfftefhheetfedt hfevgfetleevvdduveetueefheenucffohhmrghinhepkhgvrhhnvghlrdhorhhgnecuve hluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhepthihtghhohes thihtghhohdrphhiiiiirgdpnhgspghrtghpthhtohepuddvpdhmohguvgepshhmthhpoh huthdprhgtphhtthhopehkvggvsheskhgvrhhnvghlrdhorhhgpdhrtghpthhtohepvhhi rhhoseiivghnihhvrdhlihhnuhigrdhorhhgrdhukhdprhgtphhtthhopehshiiisghoth dotdefvgdurghfhegtfeefvdhfjegvtdgvsgekgegssehshiiikhgrlhhlvghrrdgrphhp shhpohhtmhgrihhlrdgtohhmpdhrtghpthhtohepsghrrghunhgvrheskhgvrhhnvghlrd horhhgpdhrtghpthhtohepjhgrtghksehsuhhsvgdrtgiipdhrtghpthhtohepvggsihgv uggvrhhmseigmhhishhsihhonhdrtghomhdprhgtphhtthhopehlihhnuhigqdhfshguvg hvvghlsehvghgvrhdrkhgvrhhnvghlrdhorhhgpdhrtghpthhtoheplhhinhhugidqmhhm sehkvhgrtghkrdhorhhgpdhrtghpthhtohepthgrnhguvghrshgvnhesnhgvthhflhhigi drtghomh X-ME-Proxy: Feedback-ID: i21f147d5:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 5 Nov 2024 14:07:06 -0500 (EST) Date: Tue, 5 Nov 2024 12:07:03 -0700 From: Tycho Andersen To: Kees Cook Cc: Al Viro , syzbot+03e1af5c332f7e0eb84b@syzkaller.appspotmail.com, Christian Brauner , Jan Kara , Eric Biederman , linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, Tycho Andersen , Zbigniew =?utf-8?Q?J=C4=99drzejewski-Szmek?= , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: Re: [PATCH] exec: NULL out bprm->argv0 when it is an ERR_PTR Message-ID: References: <20241105181905.work.462-kees@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20241105181905.work.462-kees@kernel.org> X-Rspam-User: X-Rspamd-Queue-Id: AA90916003A X-Rspamd-Server: rspam11 X-Stat-Signature: gmm9hdahcbjtin5i5qtwpmmmfaeqgew3 X-HE-Tag: 1730833607-56756 X-HE-Meta: U2FsdGVkX19utycr3bNVkHwNUnPyE2XVI5cl0K+/8uaWuFXxvnlBrRgqEcys7JL0i5bgiOkc5Ac0OwNaCMMkmZagAwctS2yf7JRInljmhdvEiME8H8YnJ9JBR7y9KVzDYj28I7yBWvKApEQZv28GOwVvRaD/0EamAHJmaYrtPPRK+NoaqZBcM6jz+DaYmIEI3verX/P7jaqhk+DNAbwUvplP4PM6uD0lmTEjs/CWTZOQIiJosYq5qt2djEbDilGoX91sMLvzFel64sZyirUYBrIyZXARSFRebHjqpF9rbSWWHxvZxqzFNJb9cl4S3tUNvomvkrcMeQohXBmkSU/SPWC4iTa+WBGM2ah9q2if7vhEOAxRaLktYKQTEB1yDfWczLtWmy2TZuNcMRxpkJOw82Bo8XnE6bz3SBUGTu6PP/Dkns/IkHS6VE7ESY0LL53mRE1EbWIs6InRih5z/xTvpouS6l7ez0YrUsp5G/bYRAezNBn6ZQyeWlQuWf3XiQmnB22quNRZ/xaNVSjqI4J0Lj2OhMp9sTCkoNuiY00mzI+EHTaggXnEJr/lZnb0iLqQF9EhjvFUw7RLobCr8i6HX9IWcDrvkWf/VSCX+Edhnk5Jzga173V+AtbXWuD2Pc9a4ww7qZG05l51tUB0gPAtbQEs8HEeDVp1BG6anlfqJ17mHrz7VXaSSsazWiqEG44G9A2Oq95V6hfpB6/ZPq96vvuwjeTNfsw4kgMDm7Hvy4W21ELvKL2WoVXELW7p2z75AcZDTnStUEXsFyZrrg9m4lNqhBQhvklX6DHzCC0USl/y6oZA70EI0OVcZaIW1uCjQPUXG6dQDrSakb4X853+DqNul4exAisQF3fy+7uM5Kzj1n8i8pM+OgMkghb8DD4viNlwsIBH9uGOsq3Be95dRq3xfcgMvtDuTCLjTZfZmWjikJ5Zw9ozNjSzSBZfZnsp9N9G80cNbWsVSvpVAD+ OS+0gHVy 4mKNGa1QWfX08QeCYEUYoZb8zDcylUFRLVTTrm+LIoKEhDOBjJnPBCv6xlzzxtUGDNO3vNBPRIRL/FJh+ZpSktvtfNeDgxQq9jVN81cJ9g8JYkISdTCq1vniXCh8KR28xGEbHyQjNEUaQMQLBddh8nsi0tt9P8FUqFrPD6vcQQ0key2+CJa2rsdyuk9bGXQTnAuS6SapbQNeqHmZVV8RK1CDCNtR4Ixje3gmbbx4WoCQMofk6F5j6QMfgPAESmwUwSMEDKtuc50IGE+TFty/gorYzx6+ROYFNO+6aFCGvdikU97TgOexQXt/qJKrIAUCAX/wAL5/+BBrCrQ79JjQz8RkIElmLrA69xNRQVcBEWQPXsujMX4jp/gmt7/iONPwCRfJ4mOzuOtR/381zMvGwR6yOF2LffLbMsgQLuHBhBVN8Cf7PP1TamgmvgCgwFuUIzWMO4OQ2O7sw6Wcpy4TSdNWXESc71SwAAPn6xekoUB9ekQCNszHLiNe7o1Lf25oC7T4x15l68noTZ09r/8A5g6aATHfeDQwBYyLnGRjhQbvOrnw= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Tue, Nov 05, 2024 at 10:19:11AM -0800, Kees Cook wrote: > Attempting to free an ERR_PTR will not work. ;) > > process 'syz-executor210' launched '/dev/fd/3' with NULL argv: empty string added > kernel BUG at arch/x86/mm/physaddr.c:23! > > Set bprm->argv0 to NULL if it fails to get a string from userspace so > that bprm_free() will not try to free an invalid pointer when cleaning up. > > Reported-by: syzbot+03e1af5c332f7e0eb84b@syzkaller.appspotmail.com > Closes: https://lore.kernel.org/all/6729d8d1.050a0220.701a.0017.GAE@google.com > Fixes: 7bdc6fc85c9a ("exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case") > Signed-off-by: Kees Cook Reviewed-by: Tycho Andersen