diff options
| author |   Oleg Nesterov <oleg@redhat.com> | 2025-03-24 17:00:03 +0100 |
|---|---|---|
| committer |   Christian Brauner <brauner@kernel.org> | 2025-03-25 14:59:05 +0100 |
| commit | af7bb0d2ca459f15cb5ca604dab5d9af103643f0 (patch) | |
| tree | 4681876f8bf4c256905b50d781315b718922bddd /net/lapb/lapb_timer.c | |
| parent | selftests/pidfd: fixes syscall number defines (diff) | |
| download | wireguard-linux-af7bb0d2ca459f15cb5ca604dab5d9af103643f0.tar.xz wireguard-linux-af7bb0d2ca459f15cb5ca604dab5d9af103643f0.zip | |
exec: fix the racy usage of fs_struct->in_exec
check_unsafe_exec() sets fs->in_exec under cred_guard_mutex, then execve()
paths clear fs->in_exec lockless. This is fine if exec succeeds, but if it
fails we have the following race:
T1 sets fs->in_exec = 1, fails, drops cred_guard_mutex
T2 sets fs->in_exec = 1
T1 clears fs->in_exec
T2 continues with fs->in_exec == 0
Change fs/exec.c to clear fs->in_exec with cred_guard_mutex held.
Reported-by: syzbot+1c486d0b62032c82a968@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/67dc67f0.050a0220.25ae54.001f.GAE@google.com/
Cc: stable@vger.kernel.org
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/r/20250324160003.GA8878@redhat.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions