Re: [syzbot] Re: kernel BUG in free_bprm()

[Kirill A. Shutemov]

On Tue, Nov 05, 2024 at 03:17:51AM -0800, syzbot wrote:
> For archival purposes, forwarding an incoming command email to
> linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.
> 
> ***
> 
> Subject: Re: kernel BUG in free_bprm()
> Author: dmantipov@xxxxxxxxx
> 
> #syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next 850f22c42f4b0a14a015aecc26f46f9948ded6dd
> 
> diff --git a/fs/exec.c b/fs/exec.c
> index ef18eb0ea5b4..df70ed8e36fe 100644
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -1496,7 +1496,8 @@ static void free_bprm(struct linux_binprm *bprm)
>  	if (bprm->interp != bprm->filename)
>  		kfree(bprm->interp);
>  	kfree(bprm->fdpath);
> -	kfree(bprm->argv0);
> +	if (!IS_ERR(bprm->argv0))
> +		kfree(bprm->argv0);
>  	kfree(bprm);
>  }

It's better to avoid setting bprm->argv0 if strndup_user() fails.

diff --git a/fs/exec.c b/fs/exec.c
index ef18eb0ea5b4..9380e166eff5 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1504,6 +1504,7 @@ static int bprm_add_fixup_comm(struct linux_binprm *bprm,
 			       struct user_arg_ptr argv)
 {
 	const char __user *p = get_user_arg_ptr(argv, 0);
+	char *argv0;
 
 	/*
 	 * If p == NULL, let's just fall back to fdpath.
@@ -1511,10 +1512,11 @@ static int bprm_add_fixup_comm(struct linux_binprm *bprm,
 	if (!p)
 		return 0;
 
-	bprm->argv0 = strndup_user(p, MAX_ARG_STRLEN);
-	if (IS_ERR(bprm->argv0))
-		return PTR_ERR(bprm->argv0);
+	argv0 = strndup_user(p, MAX_ARG_STRLEN);
+	if (IS_ERR(argv0))
+		return PTR_ERR(argv0);
 
+	bprm->argv0 = argv0;
 	return 0;
 }
 
-- 
  Kiryl Shutsemau / Kirill A. Shutemov