exec: Fix a NULL vs IS_ERR() test in bprm_add_fixup_comm()

[PATCH next] exec: Fix a NULL vs IS_ERR() test in bprm_add_fixup_comm()

Posted by Dan Carpenter 3 weeks, 1 day ago

The strndup_user() function doesn't return NULL, it returns error
pointers.  Fix the check to match.

Fixes: 7bdc6fc85c9a ("exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
 fs/exec.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index 7e24d585915e..c5c291502dca 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1512,10 +1512,10 @@ static int bprm_add_fixup_comm(struct linux_binprm *bprm,
 		return 0;
 
 	bprm->argv0 = strndup_user(p, MAX_ARG_STRLEN);
-	if (bprm->argv0)
-		return 0;
+	if (IS_ERR(bprm->argv0))
+		return PTR_ERR(bprm->argv0);
 
-	return -EFAULT;
+	return 0;
 }
 
 static struct linux_binprm *alloc_bprm(int fd, struct filename *filename, int flags)
-- 
2.45.2

Re: [PATCH next] exec: Fix a NULL vs IS_ERR() test in bprm_add_fixup_comm()

Posted by Tycho Andersen 2 weeks, 6 days ago

On Sat, Nov 2, 2024 at 3:31 AM Dan Carpenter <dan.carpenter@linaro.org> wrote:
>
> The strndup_user() function doesn't return NULL, it returns error
> pointers.  Fix the check to match.
>
> Fixes: 7bdc6fc85c9a ("exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>

Oof, thanks.

Reviewed-by: Tycho Andersen <tandersen@netflix.com>

Re: [PATCH next] exec: Fix a NULL vs IS_ERR() test in bprm_add_fixup_comm()

Posted by Kees Cook 3 weeks ago

On Sat, 02 Nov 2024 12:31:14 +0300, Dan Carpenter wrote:
> The strndup_user() function doesn't return NULL, it returns error
> pointers.  Fix the check to match.
> 
> 

Applied to for-next/execve, thanks!

[1/1] exec: Fix a NULL vs IS_ERR() test in bprm_add_fixup_comm()
      https://git.kernel.org/kees/c/05e60502723d

Take care,

-- 
Kees Cook