github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

exec: Clear bprm->mm before dropping its reference

Browse Source 
Once mmput() drops the final reference to bprm->mm, the pointer must no
longer remain accessible through struct linux_binprm.

The successful exec path and the bprm initialization error path already
clear bprm->mm when ownership is transferred or released. Do the same in
free_bprm() before calling mmput().

This is required for BPF kfuncs where bprm->mm is either NULL or points
to a live mm_struct to ensure safe access.

Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Sun Jian <sun.jian.kdev@gmail.com>
Link: https://patch.msgid.link/20260918131757.42802-3-tasos.papagiannnis@gmail.com
This commit is contained in:
Anastasios Papagiannis 2026-09-18 16:17:54 +03:00 committed by Alexei Starovoitov
parent 69d38c792c
commit adc7fb9955
No known key found for this signature in database
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
fs/exec.c
View File

@ -1456,9 +1456,12 @@ void bprm_drop_loader(struct linux_binprm *bprm)
static void free_bprm(struct linux_binprm *bprm)
{
if (bprm->mm) {
struct mm_struct *mm = bprm->mm;
if (mm) {
acct_arg_size(bprm, 0);
mmput(bprm->mm);
bprm->mm = NULL;
mmput(mm);
}
if (bprm->user_ns)
put_user_ns(bprm->user_ns);