diff options
Diffstat (limited to 'fs/exec.c')
| -rw-r--r-- | fs/exec.c | 97 |
1 files changed, 75 insertions, 22 deletions
diff --git a/fs/exec.c b/fs/exec.c index c4010b8207a1..6fcfb3f7b137 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -243,10 +243,6 @@ static void put_arg_page(struct page *page) put_page(page); } -static void free_arg_page(struct linux_binprm *bprm, int i) -{ -} - static void free_arg_pages(struct linux_binprm *bprm) { } @@ -267,7 +263,10 @@ static int __bprm_mm_init(struct linux_binprm *bprm) if (!vma) return -ENOMEM; - down_write(&mm->mmap_sem); + if (down_write_killable(&mm->mmap_sem)) { + err = -EINTR; + goto err_free; + } vma->vm_mm = mm; /* @@ -294,6 +293,7 @@ static int __bprm_mm_init(struct linux_binprm *bprm) return 0; err: up_write(&mm->mmap_sem); +err_free: bprm->vma = NULL; kmem_cache_free(vm_area_cachep, vma); return err; @@ -700,7 +700,9 @@ int setup_arg_pages(struct linux_binprm *bprm, bprm->loader -= stack_shift; bprm->exec -= stack_shift; - down_write(&mm->mmap_sem); + if (down_write_killable(&mm->mmap_sem)) + return -EINTR; + vm_flags = VM_STACK_FLAGS; /* @@ -760,6 +762,39 @@ out_unlock: } EXPORT_SYMBOL(setup_arg_pages); +#else + +/* + * Transfer the program arguments and environment from the holding pages + * onto the stack. The provided stack pointer is adjusted accordingly. + */ +int transfer_args_to_stack(struct linux_binprm *bprm, + unsigned long *sp_location) +{ + unsigned long index, stop, sp; + int ret = 0; + + stop = bprm->p >> PAGE_SHIFT; + sp = *sp_location; + + for (index = MAX_ARG_PAGES - 1; index >= stop; index--) { + unsigned int offset = index == stop ? bprm->p & ~PAGE_MASK : 0; + char *src = kmap(bprm->page[index]) + offset; + sp -= PAGE_SIZE - offset; + if (copy_to_user((void *) sp, src, PAGE_SIZE - offset) != 0) + ret = -EFAULT; + kunmap(bprm->page[index]); + if (ret) + goto out; + } + + *sp_location = sp; + +out: + return ret; +} +EXPORT_SYMBOL(transfer_args_to_stack); + #endif /* CONFIG_MMU */ static struct file *do_open_execat(int fd, struct filename *name, int flags) @@ -850,15 +885,26 @@ int kernel_read_file(struct file *file, void **buf, loff_t *size, if (ret) return ret; + ret = deny_write_access(file); + if (ret) + return ret; + i_size = i_size_read(file_inode(file)); - if (max_size > 0 && i_size > max_size) - return -EFBIG; - if (i_size <= 0) - return -EINVAL; + if (max_size > 0 && i_size > max_size) { + ret = -EFBIG; + goto out; + } + if (i_size <= 0) { + ret = -EINVAL; + goto out; + } - *buf = vmalloc(i_size); - if (!*buf) - return -ENOMEM; + if (id != READING_FIRMWARE_PREALLOC_BUFFER) + *buf = vmalloc(i_size); + if (!*buf) { + ret = -ENOMEM; + goto out; + } pos = 0; while (pos < i_size) { @@ -876,18 +922,23 @@ int kernel_read_file(struct file *file, void **buf, loff_t *size, if (pos != i_size) { ret = -EIO; - goto out; + goto out_free; } ret = security_kernel_post_read_file(file, *buf, i_size, id); if (!ret) *size = pos; -out: +out_free: if (ret < 0) { - vfree(*buf); - *buf = NULL; + if (id != READING_FIRMWARE_PREALLOC_BUFFER) { + vfree(*buf); + *buf = NULL; + } } + +out: + allow_write_access(file); return ret; } EXPORT_SYMBOL_GPL(kernel_read_file); @@ -1387,11 +1438,16 @@ static void bprm_fill_uid(struct linux_binprm *bprm) kuid_t uid; kgid_t gid; - /* clear any previous set[ug]id data from a previous binary */ + /* + * Since this can be called multiple times (via prepare_binprm), + * we must clear any previous work done when setting set[ug]id + * bits from any earlier bprm->file uses (for example when run + * first for a setuid script then again for its interpreter). + */ bprm->cred->euid = current_euid(); bprm->cred->egid = current_egid(); - if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) + if (!mnt_may_suid(bprm->file->f_path.mnt)) return; if (task_no_new_privs(current)) @@ -1481,9 +1537,6 @@ int remove_arg_zero(struct linux_binprm *bprm) kunmap_atomic(kaddr); put_arg_page(page); - - if (offset == PAGE_SIZE) - free_arg_page(bprm, (bprm->p >> PAGE_SHIFT) - 1); } while (offset == PAGE_SIZE); bprm->p++; |