diff options
| author | Oleg Nesterov <oleg@redhat.com> | 2025-03-24 19:00:03 +0300 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2025-03-25 16:59:05 +0300 |
| commit | af7bb0d2ca459f15cb5ca604dab5d9af103643f0 (patch) | |
| tree | 4681876f8bf4c256905b50d781315b718922bddd /tools/perf/scripts/python/libxed.py | |
| parent | 8661bb9c717a07b7636224339fe8818b65db6ddf (diff) | |
| download | linux-af7bb0d2ca459f15cb5ca604dab5d9af103643f0.tar.xz | |
exec: fix the racy usage of fs_struct->in_exec
check_unsafe_exec() sets fs->in_exec under cred_guard_mutex, then execve()
paths clear fs->in_exec lockless. This is fine if exec succeeds, but if it
fails we have the following race:
T1 sets fs->in_exec = 1, fails, drops cred_guard_mutex
T2 sets fs->in_exec = 1
T1 clears fs->in_exec
T2 continues with fs->in_exec == 0
Change fs/exec.c to clear fs->in_exec with cred_guard_mutex held.
Reported-by: syzbot+1c486d0b62032c82a968@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/67dc67f0.050a0220.25ae54.001f.GAE@google.com/
Cc: stable@vger.kernel.org
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/r/20250324160003.GA8878@redhat.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python/libxed.py')
0 files changed, 0 insertions, 0 deletions