Commit 3440625d78711bee41a84cf29c3d8c579b522666
1 parent
9e5cf0ca2e
Exists in
master
and in
7 other branches
flat: fix uninitialized ptr with shared libs
The new credentials code broke load_flat_shared_library() as it now uses an uninitialized cred pointer. Reported-by: Bernd Schmidt <bernds_cb1@t-online.de> Tested-by: Bernd Schmidt <bernds_cb1@t-online.de> Cc: Mike Frysinger <vapier@gentoo.org> Cc: David Howells <dhowells@redhat.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Showing 1 changed file with 12 additions and 5 deletions Side-by-side Diff
fs/binfmt_flat.c
... | ... | @@ -828,15 +828,22 @@ |
828 | 828 | if (IS_ERR(bprm.file)) |
829 | 829 | return res; |
830 | 830 | |
831 | + bprm.cred = prepare_exec_creds(); | |
832 | + res = -ENOMEM; | |
833 | + if (!bprm.cred) | |
834 | + goto out; | |
835 | + | |
831 | 836 | res = prepare_binprm(&bprm); |
832 | 837 | |
833 | 838 | if (res <= (unsigned long)-4096) |
834 | 839 | res = load_flat_file(&bprm, libs, id, NULL); |
835 | - if (bprm.file) { | |
836 | - allow_write_access(bprm.file); | |
837 | - fput(bprm.file); | |
838 | - bprm.file = NULL; | |
839 | - } | |
840 | + | |
841 | + abort_creds(bprm.cred); | |
842 | + | |
843 | +out: | |
844 | + allow_write_access(bprm.file); | |
845 | + fput(bprm.file); | |
846 | + | |
840 | 847 | return(res); |
841 | 848 | } |
842 | 849 |