diff options
| author | Andrea Arcangeli <andrea@cpushare.com> | 2017-07-25 22:22:45 +0200 |
|---|---|---|
| committer | razorloves <razorloves@gmail.com> | 2018-11-20 22:04:48 -0600 |
| commit | 919c5ed2beb8fb21d0e9013c3df9238bf8cfe240 (patch) | |
| tree | 17e0eca262d643a5fa0ebaa40d565d27aa4f032f /net/lapb/lapb_timer.c | |
| parent | d67b52d6029eb47580cd0b414f3d241990dab137 (diff) | |
fs/exec: fix use after free in execve
"file" can be already freed if bprm->file is NULL after
exec_binprm() return. binfmt_script will do exactly that for
example. If the VM reuses the file after fput run(), this will result in
a use ater free.
So obtain d_is_su before exec_binprm() runs.
This should explain this crash:
[25333.009554] Unable to handle kernel NULL pointer dereference at virtual address 00000185
[..]
[25333.009918] [2: am:21861] PC is at do_execve+0x354/0x474
Change-Id: I2a8a814d1c0aa75625be83cb30432cf13f1a0681
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions