mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-21 19:05:37 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
3349ef6a366a61d631f6a263d12cea240957719d
linux/fs
History
Christian Brauner 3349ef6a36 binfmt_elf_fdpic: only honour the first PT_INTERP 
The program header scan handles PT_INTERP from a switch nested in the
scan loop, so its break leaves the switch and not the loop. A binary
carrying more than one PT_INTERP runs the case again and overwrites both
interpreter_name and interpreter. The previous name allocation leaks and
so does the previous interpreter reference, along with the write denial
open_exec() took on it. The denial is never released, so the file stays
unwritable for as long as the system runs.

An unprivileged caller reaches this with a crafted binary and repeats it
at will. binfmt_elf stops at the first PT_INTERP. Do the same here.

The flaw dates back to the driver's introduction in the pre-git history
tree introduced in v2.6.11 by 91808d6ebe39 ("[PATCH] FRV: Add FDPIC ELF
binary format driver").

Link: https://patch.msgid.link/20260721-gezittert-medium-kreide-b41fc1f0277e@brauner
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Jori Koolstra <jkoolstra@xs4all.nl>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-21 13:22:34 +02:00
..
9p
Merge tag '9p-for-7.2-rc1' of https://github.com/martinetd/linux
2026-06-21 10:26:31 -07:00
adfs
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux
2026-04-25 07:44:26 -07:00
affs
affs: handle set_blocksize failures
2026-05-21 13:39:35 +02:00
afs
netfs: Replace wb_lock with a bit lock for asynchronicity
2026-07-01 15:26:29 +02:00
autofs
Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 14:20:11 -07:00
befs
befs: handle set_blocksize failures
2026-05-21 13:39:35 +02:00
bfs
bfs: replace get_zeroed_page() with kzalloc()
2026-05-28 13:58:14 +02:00
btrfs
Merge tag 'for-7.2-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
2026-07-14 09:10:27 -07:00
cachefiles
cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE
2026-07-01 15:26:28 +02:00
ceph
Merge tag 'ceph-for-7.2-rc1' of https://github.com/ceph/ceph-client
2026-06-26 16:15:53 -07:00
coda
Merge tag 'pull-coda' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-04-21 14:03:10 -07:00
configfs
Merge tag 'pull-configfs-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-06-15 04:28:20 +05:30
cramfs
cramfs: drop obsolete Future Development notes and update tools URL
2026-05-03 09:12:23 -06:00
crypto
fscrypt: Replace mk_users keyring with simple list
2026-06-22 12:12:11 -07:00
debugfs
debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()
2026-04-02 16:15:23 +02:00
devpts
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
dlm
dlm: init per node debugfs before add to node hash
2026-05-08 08:38:03 -05:00
ecryptfs
Merge tag 'ecryptfs-7.2-rc1-updates' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs
2026-06-26 08:24:06 -07:00
efivarfs
efivarfs: use QSTR() in efivarfs_alloc_dentry
2026-04-28 12:30:59 +02:00
efs
fs: efs: remove unneeded debug prints
2026-06-11 11:42:21 -07:00
erofs
erofs: hide "cache_strategy=" for plain filesystems
2026-07-13 16:41:42 +08:00
exfat
iomap: consolidate bio submission
2026-07-01 15:26:47 +02:00
exportfs
find_acceptable_alias(): skip NORCU aliases with zero refcount
2026-06-05 00:34:55 -04:00
ext2
ext2: fix ignored return value of generic_write_sync()
2026-06-02 10:56:16 +02:00
ext4
Merge tag 'ext4_for_linus-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
2026-06-18 09:42:02 -07:00
f2fs
f2fs: fix to round down start offset of fallocate for pin file
2026-06-22 19:55:27 +00:00
fat
fat: stop reading directory entries past the end-of-directory marker
2026-07-01 15:26:25 +02:00
freevxfs
freevxfs: don't BUG() on unknown typed-extent type
2026-07-01 15:26:26 +02:00
fuse
fuse: call fuse_send_readpages explicitly from fuse_readahead
2026-07-01 15:26:47 +02:00
gfs2
Merge tag 'gfs2-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2
2026-06-26 15:13:06 -07:00
hfs
Merge tag 'hfs-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs
2026-06-16 12:27:23 +05:30
hfsplus
Merge tag 'hfs-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs
2026-06-16 12:27:23 +05:30
hostfs
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
hpfs
Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-06-15 03:59:45 +05:30
hugetlbfs
mm: use mapping_mapped to simplify the code
2026-06-21 11:37:38 -07:00
iomap
iomap: submit read bio after each extent
2026-07-01 15:26:47 +02:00
isofs
Merge tag 'fs_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2026-06-16 11:58:52 +05:30
jbd2
Merge tag 'ext4_for_linus-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
2026-06-18 09:42:02 -07:00
jffs2
treewide: change inode->i_ino from unsigned long to u64
2026-03-06 14:31:28 +01:00
jfs
Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-06-15 03:59:45 +05:30
kernfs
Merge tag 'driver-core-7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/driver-core/driver-core
2026-06-15 12:41:17 +05:30
lockd
lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()
2026-06-09 16:32:59 -04:00
minix
minix: avoid overflow in bitmap block count calculation
2026-07-01 15:26:24 +02:00
netfs
netfs: Fix barriering when walking subrequest list
2026-07-03 11:52:41 +02:00
nfs
NFS: Charge unstable writes by request size, not folio size
2026-07-08 14:43:40 -04:00
nfs_common
NFSD: Remove NFSERR_EAGAIN
2026-01-02 13:43:41 -05:00
nfsd
Merge tag 'nfsd-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
2026-07-13 08:38:01 -07:00
nilfs2
Merge tag 'nilfs2-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2
2026-06-16 12:14:20 +05:30
nls
fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
2025-12-01 11:58:06 +02:00
notify
Merge tag 'fsnotify_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2026-06-16 11:56:43 +05:30
ntfs
Merge tag 'ntfs-for-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs
2026-07-10 18:20:15 -07:00
ntfs3
iomap: consolidate bio submission
2026-07-01 15:26:47 +02:00
ocfs2
Merge tag 'mm-nonmm-stable-2026-06-21-10-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-06-21 13:20:19 -07:00
omfs
omfs: handle set_blocksize failures
2026-05-21 13:39:36 +02:00
openpromfs
Coccinelle-based conversion to use ->i_state accessors
2025-10-20 20:22:26 +02:00
orangefs
orangefs: keep the readdir entry size 64-bit in fill_from_part()
2026-07-01 15:26:27 +02:00
overlayfs
ovl: fix comment about locking order
2026-07-01 15:26:25 +02:00
proc
Merge tag 'mm-hotfixes-stable-2026-07-06-17-49' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-07-06 18:51:36 -07:00
pstore
Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-15 12:59:16 -07:00
qnx4
qnx4: handle set_blocksize failures
2026-05-21 13:39:35 +02:00
qnx6
fs/qnx6: fix pointer arithmetic in directory iteration
2026-05-28 14:16:33 +02:00
quota
quota: allocate dquot_hash with kmalloc()
2026-05-27 15:12:22 +02:00
ramfs
folio_batch: rename pagevec.h to folio_batch.h
2026-04-05 13:53:07 -07:00
resctrl
fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
2026-07-06 19:05:49 -07:00
romfs
Merge tag 'mm-stable-2026-02-18-19-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-02-18 20:50:32 -08:00
smb
Merge tag 'v7.2-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd
2026-07-17 21:41:54 -07:00
squashfs
Squashfs: check metadata block offset is within range
2026-02-24 11:13:27 -08:00
sysfs
Merge tag 'driver-core-7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/driver-core/driver-core
2026-06-15 12:41:17 +05:30
tests
fs/tests: exec: Remove bad test vector
2026-03-18 11:41:53 -07:00
tracefs
tracefs: use d_splice_alias() in ->lookup() instances
2026-06-05 01:12:15 -04:00
ubifs
fs: add icount_read_once() and stop open-coding ->i_count loads
2026-05-11 23:12:28 +02:00
udf
Merge tag 'fs_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2026-06-16 11:58:52 +05:30
ufs
Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 12:46:42 -07:00
unicode
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
vboxsf
vboxsf: Implement fileattr_get for case sensitivity
2026-05-11 16:50:29 +02:00
verity
Merge tag 'bpf-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2026-06-17 09:18:14 +01:00
xfs
Merge tag 'xfs-fixes-7.2-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
2026-07-16 09:40:03 -07:00
zonefs
zonefs: handle integer overflow in zonefs_fname_to_fno
2026-05-12 07:53:20 +09:00
aio.c
libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers
2026-06-04 10:10:49 +02:00
anon_inodes.c
libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers
2026-06-04 10:10:49 +02:00
attr.c
filelock: add support for ignoring deleg breaks for dir change events
2026-05-15 19:24:32 +02:00
backing-file.c
backing-file: fix backing_file_open() kerneldoc parameter
2026-06-10 09:49:25 +02:00
bad_inode.c
fs: refactor ->update_time handling
2026-01-12 14:01:32 +01:00
binfmt_elf_fdpic.c
binfmt_elf_fdpic: only honour the first PT_INTERP
2026-07-21 13:22:34 +02:00
binfmt_elf.c
mm: unexport vm_brk_flags() and eliminate vm_flags parameter
2026-04-05 13:53:39 -07:00
binfmt_flat.c
…
binfmt_misc.c
binfmt_misc: set have_execfd only once the interpreter is opened
2026-07-20 23:34:15 +02:00
binfmt_script.c
…
bpf_fs_kfuncs.c
bpf: have bpf_real_data_inode() take a struct file
2026-07-01 15:26:27 +02:00
buffer.c
Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-06-15 03:59:45 +05:30
char_dev.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
compat_binfmt_elf.c
…
coredump.c
Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-06-15 03:59:45 +05:30
d_path.c
dcache: permit dynamic_dname()s up to NAME_MAX
2026-04-07 12:32:22 +02:00
dax.c
Merge tag 'libnvdimm-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
2026-04-21 14:12:01 -07:00
dcache.c
Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-06-15 04:15:31 +05:30
direct-io.c
direct-io: remove IOCB_NOWAIT support
2026-05-26 11:01:55 -06:00
drop_caches.c
Coccinelle-based conversion to use ->i_state accessors
2025-10-20 20:22:26 +02:00
eventfd.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
eventpoll.c
eventpoll: restore EP_UNACTIVE_PTR sentinel for ctx->tfile_check_list
2026-06-04 13:53:50 +02:00
exec.c
exec: fix unsigned loop counter wrap in transfer_args_to_stack()
2026-07-21 13:00:49 +02:00
fcntl.c
Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-06-15 03:59:45 +05:30
fhandle.c
fhandle: reject detached mounts in capable_wrt_mount()
2026-07-01 15:26:32 +02:00
file_attr.c
fs: Add case sensitivity flags to file_kattr
2026-05-11 16:50:27 +02:00
file_table.c
Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-06-15 04:15:31 +05:30
file.c
fs: retire stale comment in fget_task_next()
2026-05-28 14:27:00 +02:00
filesystems.c
fs: fix ups and tidy ups to /proc/filesystems caching
2026-06-12 14:26:27 +02:00
fs_context.c
Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 14:20:11 -07:00
fs_dirent.c
fs: rename fs_types.h to fs_dirent.h
2025-11-05 09:51:30 +01:00
fs_parser.c
fs: remove fsparam_path / fs_param_is_path
2026-02-19 14:34:26 +01:00
fs_pin.c
…
fs_struct.c
fs: add <linux/init_task.h> for 'init_fs'
2026-01-14 16:50:37 +01:00
fs-writeback.c
mm: kick writeback flusher for IOCB_DONTCACHE with targeted dirty tracking
2026-06-04 10:16:51 +02:00
fserror.c
treewide: change inode->i_ino from unsigned long to u64
2026-03-06 14:31:28 +01:00
fsopen.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
init.c
Merge tag 'pull-filename' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-02-09 16:58:28 -08:00
inode.c
Merge tag 'mm-stable-2026-06-23-08-55' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-06-23 12:03:44 -07:00
internal.h
fuse: invalidate page cache after DIO and async DIO writes
2026-06-15 14:06:20 +02:00
ioctl.c
…
Kconfig
treewide: fix indentation and whitespace in Kconfig files
2026-05-28 21:24:42 -07:00
Kconfig.binfmt
…
kernel_read_file.c
…
libfs.c
Merge tag 'pull-d_add' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-06-15 04:21:00 +05:30
locks.c
filelock: add an inode_lease_ignore_mask helper
2026-05-15 19:24:32 +02:00
Makefile
userfaultfd: merge fs/userfaultfd.c into mm/userfaultfd.c
2026-06-04 14:45:03 -07:00
mbcache.c
Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-04-13 14:20:11 -07:00
mnt_idmapping.c
fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap
2026-05-11 14:19:01 +02:00
mount.h
Merge tag 'vfs-7.2-rc1.procfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-06-15 04:07:58 +05:30
mpage.c
Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-04-15 12:59:16 -07:00
namei.c
fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
2026-07-01 15:26:18 +02:00
namespace.c
Merge tag 'vfs-7.2-rc1.procfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-06-15 04:07:58 +05:30
nsfs.c
Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-06-15 03:59:45 +05:30
nullfs.c
fs: add immutable rootfs
2026-01-12 16:52:09 +01:00
open.c
Merge tag 'mm-stable-2026-06-23-08-55' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
2026-06-23 12:03:44 -07:00
pidfs.c
Merge tag 'fsnotify_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2026-06-16 11:56:43 +05:30
pipe.c
fs/pipe: pre-allocate pages outside pipe->mutex in anon_pipe_write
2026-05-28 14:33:24 +02:00
pnode.c
…
pnode.h
…
posix_acl.c
filelock: add support for ignoring deleg breaks for dir change events
2026-05-15 19:24:32 +02:00
proc_namespace.c
…
read_write.c
fs/read_write: Do not export __kernel_write() to the entire world
2026-06-05 14:46:20 +02:00
readdir.c
fs: Replace user_access_{begin/end} by scoped user access
2026-03-24 14:44:02 +01:00
remap_range.c
…
select.c
Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2026-06-15 03:59:45 +05:30
seq_file.c
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
2026-02-21 01:02:28 -08:00
signalfd.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
splice.c
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
2026-02-21 17:09:51 -08:00
stack.c
…
stat.c
statx: switch to CLASS(filename_maybe_null)
2026-01-16 12:52:04 -05:00
statfs.c
user_statfs(): switch to CLASS(filename)
2026-01-16 12:52:04 -05:00
super.c
Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2026-06-15 04:15:31 +05:30
sync.c
sync_file_range: delete dead S_ISLNK code
2026-05-21 13:39:36 +02:00
sysctls.c
…
timerfd.c
fs/timerfd: Use the new alarm/hrtimer functions
2026-05-01 21:36:13 +02:00
utimes.c
do_utimes_path(): switch to CLASS(filename_uflags)
2026-01-16 12:52:03 -05:00
xattr.c
Merge tag 'lsm-pr-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm
2026-06-17 12:34:16 +01:00