[PATCH] exec: serialize argument stack bounds checks with relocation

[Kyle Zeng]

setup_new_exec() drops the exec locks before setup_arg_pages(). At that
point a ptrace-authorized task can reach the new mm through /proc/pid/mem
and expand its temporary stack.

setup_arg_pages() validates the size and computes stack_shift before
taking the mmap write lock. If remote stack expansion wins that lock in
between, relocate_vma_down() instead uses the enlarged VMA. On a
native-to-compat exec this can move the stack below mmap_min_addr,
including to address zero. A still larger expansion can also underflow
the new start and hit the relocation BUG_ON().

Acquire the mmap write lock before inspecting the VMA bounds in either
stack-growth direction. Keep the existing locked relocation and send
both size-check failures through out_unlock. The size check and the
range passed to relocation now describe the same VMA.

Assisted-by: Codex:gpt-6-astra
Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
---
 fs/exec.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index 819643408e6d..1ab09c5ebdda 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -617,6 +617,13 @@ int setup_arg_pages(struct linux_binprm *bprm,
 	struct mmu_gather tlb;
 	struct vma_iterator vmi;
 
+	/*
+	 * The temporary stack can be expanded by a remote memory access.
+	 * Hold the mmap_lock from the bounds checks through the relocation.
+	 */
+	if (mmap_write_lock_killable(mm))
+		return -EINTR;
+
 #ifdef CONFIG_STACK_GROWSUP
 	/* Limit stack size */
 	stack_base = bprm->rlim_stack.rlim_max;
@@ -628,8 +635,10 @@ int setup_arg_pages(struct linux_binprm *bprm,
 		stack_base += (STACK_RND_MASK << PAGE_SHIFT);
 
 	/* Make sure we didn't let the argument array grow too large. */
-	if (vma->vm_end - vma->vm_start > stack_base)
-		return -ENOMEM;
+	if (vma->vm_end - vma->vm_start > stack_base) {
+		ret = -ENOMEM;
+		goto out_unlock;
+	}
 
 	stack_base = PAGE_ALIGN(stack_top - stack_base);
 
@@ -641,8 +650,10 @@ int setup_arg_pages(struct linux_binprm *bprm,
 	stack_top = PAGE_ALIGN(stack_top);
 
 	if (unlikely(stack_top < mmap_min_addr) ||
-	    unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
-		return -ENOMEM;
+	    unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr)) {
+		ret = -ENOMEM;
+		goto out_unlock;
+	}
 
 	stack_shift = vma->vm_end - stack_top;
 
@@ -652,9 +663,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
 
 	bprm->exec -= stack_shift;
 
-	if (mmap_write_lock_killable(mm))
-		return -EINTR;
-
 	vm_flags = VM_STACK_FLAGS;
 
 	/*

base-commit: fd179f8a05be3ccae366b9b96e176b51fbe54aab