From 7f827caa2625b3ae3f21d4b662ad7a583e46b455 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa Date: Tue, 26 Feb 2019 21:16:35 +0800 Subject: [PATCH] fs: Allow opening only regular files during execve() euler inclusion category: bugfix bugzilla: 10703 CVE: NA --------------------------- syzbot is hitting lockdep warning [1] due to trying to open a fifo during an execve() operation. But we don't need to open non regular files during an execve() operation, for all files which we will need are the executable file itself and the interpreter programs like /bin/sh and ld-linux.so.2. Since the manpage for execve(2) says that execve() returns EACCES when the file or a script interpreter is not a regular file, and the manpage for uselib(2) says that uselib() can return EACCES, and we use FMODE_EXEC when opening for execve()/uselib(), let's bail out if a non regular file is requested with FMODE_EXEC set. Link: https://lore.kernel.org/patchwork/patch/1034270/ Signed-off-by: Tetsuo Handa Signed-off-by: zhengbin Reviewed-by: Hou Tao Signed-off-by: Yang Yingliang --- fs/open.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/open.c b/fs/open.c index 0285ce7dbd51..f1c2f855fd43 100644 --- a/fs/open.c +++ b/fs/open.c @@ -733,6 +733,12 @@ static int do_dentry_open(struct file *f, return 0; } + /* Any file opened for execve()/uselib() has to be a regular file. */ + if (unlikely(f->f_flags & FMODE_EXEC && !S_ISREG(inode->i_mode))) { + error = -EACCES; + goto cleanup_file; + } + if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { error = get_write_access(inode); if (unlikely(error)) -- GitLab