diff options
| author | Sun Jian <sun.jian.kdev@gmail.com> | 2026-09-01 04:40:11 -0700 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-09-03 09:23:44 +0200 |
| commit | 115bf3e51538e74159e9fa46199468b69fd5df70 (patch) | |
| tree | 2e620e854f23daf774a0146293beac3f682f6e09 | |
| parent | e14d4302cbd0de773960bec33c2281508c8d8855 (diff) | |
exec: Drop bprm loader before closing bprm->file
free_bprm() currently drops what may be the final reference to
bprm->file before calling bprm_drop_loader(). Since
bprm_drop_loader() is attachable via BPF fentry and bprm->file is
exposed as a BTF_TYPE_SAFE_TRUSTED pointer, the file can be observed
after its reference has been released.
Move bprm_drop_loader() before do_close_execat(bprm->file), keeping
the file reference held while the hook runs. This preserves the
existing trusted BTF contract without changing verifier behavior.
The loader file and bprm->file have independent references, so this
reordering does not change their required teardown ordering.
Link: https://sashiko.dev/#/patchset/20260831092305.42062-1-tasos.papagiannnis@gmail.com?part=3
Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com>
Link: https://patch.msgid.link/20260901114011.112375-1-sun.jian.kdev@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
| -rw-r--r-- | fs/exec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/exec.c b/fs/exec.c index a14f28b15607..263b1f67f1f8 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1469,9 +1469,9 @@ static void free_bprm(struct linux_binprm *bprm) /* exec swapped the mm but failed before setup_new_exec() freed it */ if (bprm->old_mm) exec_mm_put_old(bprm->old_mm); - do_close_execat(bprm->file); /* An unconsumed PT_INTERP substitute from a binfmt_misc loader entry. */ bprm_drop_loader(bprm); + do_close_execat(bprm->file); do_close_execat(bprm->executable); /* If a binfmt changed the interp, free it. */ if (bprm->interp != bprm->filename) |