Received-SPF: pass (google.com: domain of linux-kernel+bounces-26434-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Message-ID:
 <AS8P193MB1285304CE97348D62021C878E46C2@AS8P193MB1285.EURP193.PROD.OUTLOOK.COM>
Date: Mon, 15 Jan 2024 20:22:01 +0100
User-Agent: Mozilla Thunderbird
From: Bernd Edlinger <bernd.edlinger@hotmail.de>
Subject: [PATCH v2] Fix error handling in begin_new_exec
To: Alexander Viro <viro@zeniv.linux.org.uk>,
 Christian Brauner <brauner@kernel.org>, Kees Cook <keescook@chromium.org>,
 "Eric W. Biederman" <ebiederm@xmission.com>,
 "linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
 linux-mm@kvack.org,
 "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
 Andrew Morton <akpm@linux-foundation.org>
References: <AM8PR10MB47081071E64EAAB343196D5AE4399@AM8PR10MB4708.EURPRD10.PROD.OUTLOOK.COM>
Content-Language: en-US
In-Reply-To: <AM8PR10MB47081071E64EAAB343196D5AE4399@AM8PR10MB4708.EURPRD10.PROD.OUTLOOK.COM>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: AS8P193MB1285:EE_|AM0P193MB0769:EE_
X-MS-Office365-Filtering-Correlation-Id: 02e9d96b-5296-4a6c-a742-08dc15ff1e19
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
	qsgKRZUqQTFb0YD5iFDICxYFdJvPAy56QXkEB2QVnlxk5Ii3HEO3TZckaty8ixaTBX5V8R4831XfBN9Rb3Z+BbcGB0mOJXDQflZxCDN7+BsdNejzHejnzcpCyqViJSj1QZNH6rejj103c/fFf2xSflIjsR7QvURXH8mXCrNjXo9p9FyYJQ4YJZOFNoZhx/RbXCkJooXyiJfg0TBfhAweELpQKbxYCaHEcxkZ50iAJNYtcmq10fqiv/WsdrwGMCvJpdwMXddRwGbt2bTgbljSR0bg7l3HGqQoqHu/vofKdUtWs8HU3xmrIZXdOFWBViXXTchjYfJUfOFiLmOU86/xxdKtCVkJx759xWBkZ5i8qeDqN50gSsnjgsL57ArnHP6WMqU9BMivQrstR2jIAYqgXUR70O4+s3jFTT8sn/f0g9zdnqCE1f+BtpXu1xxpR0sO6e9K14PJQWd8u4tJPfj9+S/i4iyxLapatXziJUoS8HTic00HAynk/pLIscPz89XKJYXHff1ei3d1Yr0ChSabYJHBHDONEeegMlSOrZ4p6fMNG/KNZpLpyv/obE+u7hBU6UEcbX1OCj5RJ+0axvi8BMm8ajG8r3NE350y8fN6eNg=
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?utf-8?B?YTA0MW5KTmlhQUtnU0t1VnpsU0l5OFhaTUtJR01FeThwL3JPTmtNRmErQWU1?=
 =?utf-8?B?Q2V3UVhIdGRoODFtZW5iZVlMODVZcmJuL3VrOU0xUmxCRko3bDRzT0ZwMWhk?=
 =?utf-8?B?aU4vcE9HaUtScW8xbk5tY3NIRFlpYmZlWjYyRWNsaWV3ajBQdTMrbFJudjFz?=
 =?utf-8?B?R1JaS0taYWhjNTNmNmR1VFIrdWkzdmcydFhSME1xYTBrbUJtL3VabkEyaTFI?=
 =?utf-8?B?S2tycHN0R00vZmlOeFh4QkhJWW1TL1ZIVFA1Z0tKVUJmVm1OdVg2SE1RbmlF?=
 =?utf-8?B?QXQ1WjBvTElxRGhUcHhIM1ozWWZKQnBRUmJDeVNmaU5SRk50RGpVb1l5Z1JI?=
 =?utf-8?B?aEJMTlpnVFdqU2xmRTlSaHZDMmZJNUhpTk51YktOTFREaTUzTlBuMWdaZWtU?=
 =?utf-8?B?RVJUelFGd0lXcmJZTUc1bWZFT0h0NGgzUDgyK1BHM0o5aTl2aTBqTzJhZUhq?=
 =?utf-8?B?NGJsa3I2V2oxcTBybkl1T3dHTnJobm9ZVzhXeDFSOHRieFRtS2ZldkpoSFJK?=
 =?utf-8?B?dWU4QytDYko2bVk4dWI5MjFsRVg5M3NpNkY1dDJnUnFzNVBGK1UvcnBYdlRw?=
 =?utf-8?B?aUtYd1hMcUZGQWNRazlUNmVEWnZNeHYvVW8wUGxjK0E4KzhYaW5vUWRXUEpn?=
 =?utf-8?B?YjBpeDIrS2s1ejQ4dythQzNzUUNvYmZjZjVVbStpMXg1QlJVc2R0Ny9jMVk0?=
 =?utf-8?B?V0VOdFNTZ3RKSENHSzdCSFBmcU9FdjNiN2x0ZVFUSWxpTXhPNGJ1VHdtR1Vo?=
 =?utf-8?B?OFNtcnREU2FXMytDSE5FMEZGUHdoMFU0MnBhMHF0aXhKclBGTzNJWk1oaFFv?=
 =?utf-8?B?bk5jS1ZJMTlRMisvY1JvNEI0TkVoa3poK2FKUExsUm5STnFVb1lWditKcnhD?=
 =?utf-8?B?T2dhVldFdmV2S1dONUpsSzQwRkpNa2RvUHJrdnF0NDFrSDFPK0tNV1F6VDQ0?=
 =?utf-8?B?WSs1NThEYyt3MTdvMnN6V09yUjB4KzE5T09mNi9iNllaR2lTcUlDb1Z6bFNr?=
 =?utf-8?B?QWtMZmdXZ0dTcGIyVmo4cGhRMDNLTy8vZWU5NDkwOUEwdkJYMlhmaWFmUnJ2?=
 =?utf-8?B?UG1mMEpqU0oyNWQxN1lOQkJUOWdYK3o2dHVLWElHb1lyd1ErMVEycVRubnBS?=
 =?utf-8?B?OERhSmhtcTk0L1J6V3E3dnNNNFhDV1FYNHlISGNvU3VrOC9rOVJNRlVZVFpy?=
 =?utf-8?B?Vktla1JZdDYxSlY2SGFxRStVQmNzR2RXNm1CRVJlYmRyR0VVb0pCYmI3UEtz?=
 =?utf-8?B?S0luV1FUZ1g3bWEzMnhLcXhsaUdXMnUyTThwZU95aCtpTXZ2WTZEeE00OXRH?=
 =?utf-8?B?RE93c0RPTGhTdUVjOEdBTFErelhpV1hnWWhBcktsYWNWZHRLUFgvMXliL0lI?=
 =?utf-8?B?bDRxbjQxakp3WHVUTTZMVEl4YjlMSWtMN1NaRHVWOEVCSUJqUDdwU0RoSng5?=
 =?utf-8?B?YlQ5Q1h5dFpiQmo5SFI5Q2ZkcVVMRFRDMVhuVCtpc1JHQ013ZUxNcmkyckpR?=
 =?utf-8?B?eVJhaHVYdlplMXNFOW1Gek5tQk1PWDZWN2tCK0dPK1cyTHlqSDhKaEFnYmJ5?=
 =?utf-8?B?c2pKZnNEeTAzWHdmd2VaT0MxYlA0VUxLVHVNZll1OUEwTnpIR2J4SVpyaktF?=
 =?utf-8?B?SUdxRDB5QVFWZDhZdHVLbXhEZWlTNEZPOER1bHMwcnF1RVlBbVdMTXB6cnE2?=
 =?utf-8?B?WmJZVFh2NXZUSVZTVWRETFg0R2JKdUozdFk2YUkrdkhSeEdOTWN2V0xXWi9U?=
 =?utf-8?Q?6vDfcgrwhLPrFpisks=3D?=
X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-80ceb.templateTenant
X-MS-Exchange-CrossTenant-Network-Message-Id: 02e9d96b-5296-4a6c-a742-08dc15ff1e19
X-MS-Exchange-CrossTenant-AuthSource: AS8P193MB1285.EURP193.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Jan 2024 19:21:04.9906
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
	00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0P193MB0769

If get_unused_fd_flags() fails, the error handling is incomplete
because bprm->cred is already set to NULL, and therefore
free_bprm will not unlock the cred_guard_mutex.
Note there are two error conditions which end up here,
one before and one after bprm->cred is cleared.

Fixes: b8a61c9e7b4a ("exec: Generic execfd support")

Signed-off-by: Bernd Edlinger <bernd.edlinger@hotmail.de>

Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
---
 fs/exec.c | 3 +++
 1 file changed, 3 insertions(+)

v2: rebased to v6.7, retested and updated the commit message
to fix a checkpatch.pl style nit about the too short sha1 hash
in the Fixes: statement.
And retained Eric's Acked-by from:
https://lore.kernel.org/lkml/87mts2kcrm.fsf@disp2133/


Thanks
Bernd.

diff --git a/fs/exec.c b/fs/exec.c
index 4aa19b24f281..6d9ed2d765ef 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1408,6 +1408,9 @@ int begin_new_exec(struct linux_binprm * bprm)
 
 out_unlock:
 	up_write(&me->signal->exec_update_lock);
+	if (!bprm->cred)
+		mutex_unlock(&me->signal->cred_guard_mutex);
+
 out:
 	return retval;
 }
-- 
2.39.2