diff options
| author | Sun Jian <sun.jian.kdev@gmail.com> | 2026-09-01 04:40:11 -0700 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-09-03 09:23:44 +0200 |
| commit | 115bf3e51538e74159e9fa46199468b69fd5df70 (patch) | |
| tree | 2e620e854f23daf774a0146293beac3f682f6e09 /tools/lib/python/kdoc/python_version.py | |
| parent | e14d4302cbd0de773960bec33c2281508c8d8855 (diff) | |
exec: Drop bprm loader before closing bprm->file
free_bprm() currently drops what may be the final reference to
bprm->file before calling bprm_drop_loader(). Since
bprm_drop_loader() is attachable via BPF fentry and bprm->file is
exposed as a BTF_TYPE_SAFE_TRUSTED pointer, the file can be observed
after its reference has been released.
Move bprm_drop_loader() before do_close_execat(bprm->file), keeping
the file reference held while the hook runs. This preserves the
existing trusted BTF contract without changing verifier behavior.
The loader file and bprm->file have independent references, so this
reordering does not change their required teardown ordering.
Link: https://sashiko.dev/#/patchset/20260831092305.42062-1-tasos.papagiannnis@gmail.com?part=3
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
Link: https://patch.msgid.link/20260901114011.112375-1-sun.jian.kdev@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions