From nobody Fri Sep 25 00:40:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D3F073AB48C; Fri, 18 Sep 2026 09:20:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789723214; cv=none; b=Zh/NfrzTTNpgPo2kvI1LA4HTe72K2htRFsbwJiwqZ6z8UVvt7BZXj+QGGvy308G22cnSgoJFJ+KIsA6rcnAzf57IPokYTgB1ZVzUwjIH/uBDOgK7jLZOM/SKDjG0I+aLOdQ7guwnGllth+v5sC5+wOEx3FcUxA9TFM3WBopx0U8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789723214; c=relaxed/simple; bh=tDr7XkPAXUmUhAgolShr3Kj+oh5yuZ7vNa0c/U9YfH8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Nh4ekDEuCO9RXtjScnXu0ofBBNTcxhUlCrKP2l/t6AyHZJW3ESZXIzp/kUIiegZldSBcRQ1Uokd3pd+5FkKmvg1r1XiucF24mcHU6utGqiVc28PrBp2vh1myFQlEysR2MVQlEBZk1Yo63DTvMR0qHoW8AbO1NXS1RrN+0wz4fmA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ZSS+1b+c; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ZSS+1b+c" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D08151F00893; Fri, 18 Sep 2026 09:20:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789723212; bh=30xzmZCW+6HrhaUbTYGuNvdh+dAtTOvqeFt7mxq9frY=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=ZSS+1b+cDnDf88HFOj9p/K2WQbsDG052jTPK5sY5EipxYuElwpcVtfenn+XI78x6w ZuFJHWYF1um614nB2nrsMiFPhfOQefihSfQfHbT36JJsB7nRc6P+Ens2E7Hr0f7bYe xQUaffYT/L5kkA6XVyE0+JGYjQFAJ1Ulb2onK+PiKvdIVrTw5jkN290CHy6xhV5zje 5+obxfxc4Tc2YBq4RFffHzLpD4+tsZsos+6zt8+L9qQrWfaCy1THdlOxo5GervYzFB j1q11VIomS2R4RPe3lvelfW8RX1BBpjiaEwm5a68mlG1bJ21GfG3mhUEu2g8OAB/FK Ue/+KdKBK7M7w== From: Christian Brauner Date: Fri, 18 Sep 2026 11:19:59 +0200 Subject: [PATCH 1/2] binfmt_misc: fix OOB read in bpf_binprm_select_interp() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260918-work-binfmt_misc-fixes-v1-1-647b24bc1c46@kernel.org> References: <20260918-work-binfmt_misc-fixes-v1-0-647b24bc1c46@kernel.org> In-Reply-To: <20260918-work-binfmt_misc-fixes-v1-0-647b24bc1c46@kernel.org> To: Chris Mason , linux-fsdevel@vger.kernel.org Cc: Alexander Viro , Jan Kara , linux-mm@kvack.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, "Christian Brauner (Amutable)" X-Mailer: b4 0.17-dev-db0b7 X-Developer-Signature: v=1; a=openpgp-sha256; l=4984; i=brauner@kernel.org; h=from:subject:message-id; bh=R6XSAxqcNhFzj5zbjdedhZcJqmgmYcg/QBbKgJYDpAc=; b=owGbwMvMwCU28Zj0gdSKO4sYT6slMWStZXJLeRO8gMXK48LXfVOrNUKKSjdvZntVliBQLfviL V/7B8OojlIWBjEuBlkxRRaHdpNwueU8FZuNMjVg5rAygQxh4OIUgIl8XsjwV6794oojxstLCmbO YLvS0FmxZgIf84T55SYTs/jkGbQE0xj+2RybzVXwhGFrrPK7P9e8lGvkpTadSTOTLEtOrn7ZL/G CAQA= X-Developer-Key: i=brauner@kernel.org; a=openpgp; fpr=4880B8C9BD0E5106FC070F4F7B3C391EFEA93624 From: Chris Mason bpf_binprm_select_interp() checks the name its load program passes with strnlen(name, name__sz) and then hands the same buffer to binfmt_misc_find_interp(), which compares it with an unbounded strcmp(). The buffer can be a BPF map value that another CPU rewrites between the two reads. If the terminating NUL is overwritten in that window, strcmp() reads past the name__sz bytes the verifier checked. That is an out-of-bounds read of up to 31 bytes of whatever follows the checked name__sz bytes. The verifier checks the name and name__sz pair with BPF_READ | BPF_WRITE, so a writable array map value is an accepted argument. bpf(BPF_MAP_UPDATE_ELEM) on an array map copies the new value over the old one in place and takes no lock. The NUL that strnlen() finds can be overwritten before strcmp() reads the buffer again: CPU0 CPU1 bpf_binprm_select_interp() strnlen(name, name__sz) finds the NUL inside name__sz bpf(BPF_MAP_UPDATE_ELEM) array_map_update_elem() copy_map_value() overwrites the NUL binfmt_misc_find_interp() strcmp(interp->name, name) reads past name__sz strnlen() proves that a NUL lies inside name__sz only at the moment it runs. The map update on CPU1 takes no lock, so it can store over the NUL right after. The lookup on CPU0 then walks the live buffer again, once per bound interpreter: fs/binfmt_misc.c:binfmt_misc_find_interp list_for_each_entry(interp, interps, list) if (!strcmp(interp->name, name)) return interp; strcmp() stops at the first mismatch or at the end of interp->name. bm_entry_add_interp() caps a bound name at BINFMT_MISC_INTERP_NAME_MAX (32) bytes, so strcmp() reads at most 33 bytes of name. The smallest name__sz the kfunc accepts is 2, which leaves up to 31 bytes read beyond the checked extent. The handler's own load program has to pass a writable map value, and something has to store into it while the kfunc runs. The window between strnlen() and strcmp() is short, but with a BPF_F_MMAPABLE array the store is a plain user space write into the mapped value, so a loop can hit it without a single bpf() call. Copy the name into a stack buffer of BINFMT_MISC_INTERP_NAME_MAX + 1 bytes, terminate it, and look up the copy. The memcpy() length is below name__sz, so the copy stays inside the extent the verifier checked, and the BPF buffer is not read again afterwards. Return -ENOENT first for a name longer than BINFMT_MISC_INTERP_NAME_MAX. bm_entry_add_interp() rejects a longer name, and the only other binding site attaches the empty name. No entry can bind such a name, so that lookup already ended in -ENOENT and no result changes. Check the first byte of the copy and return -EINVAL if it is NUL, as the existing "!len" test does for an empty name. Only an 'F' entry binds the empty name and a 'B' entry cannot carry 'F', so without that check a racing store of NUL to byte 0 would look up a name no entry binds and end in -ENOENT rather than -EINVAL. A NUL stored further into the name only shortens it to another name the program could have passed anyway. binfmt_misc_find_interp() itself is left alone: entry_attach_interpreter() calls it with a kernel string, and this kfunc now calls it with a private copy. Fixes: 6ec7c96bee30 ("binfmt_misc: let a 'B' entry bind its interpreters") Signed-off-by: Chris Mason Signed-off-by: Christian Brauner (Amutable) Acked-by: Kumar Kartikeya Dwivedi --- fs/binfmt_misc_bpf.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/fs/binfmt_misc_bpf.c b/fs/binfmt_misc_bpf.c index 91576ff05911..ce1bc78e8511 100644 --- a/fs/binfmt_misc_bpf.c +++ b/fs/binfmt_misc_bpf.c @@ -176,6 +176,7 @@ __bpf_kfunc int bpf_binprm_select_interp(struct linux_b= inprm *bprm, const char *name, size_t name__sz) { const struct binfmt_misc_interp *interp; + char buf[BINFMT_MISC_INTERP_NAME_MAX + 1]; size_t len; char *path; =20 @@ -184,8 +185,20 @@ __bpf_kfunc int bpf_binprm_select_interp(struct linux_= binprm *bprm, len =3D strnlen(name, name__sz); if (len =3D=3D name__sz || !len) return -EINVAL; + /* No entry binds a longer name, so it cannot be found. */ + if (len > BINFMT_MISC_INTERP_NAME_MAX) + return -ENOENT; + + /* + * The program may pass memory that is written to while this runs, + * so look the name up in a private copy and check that instead. + */ + memcpy(buf, name, len); + buf[len] =3D '\0'; + if (!buf[0]) + return -EINVAL; =20 - interp =3D binfmt_misc_find_interp(bprm->bpf_interps, name); + interp =3D binfmt_misc_find_interp(bprm->bpf_interps, buf); if (!interp) return -ENOENT; =20 --=20 2.53.0 From nobody Fri Sep 25 00:40:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 352C53D34B6; Fri, 18 Sep 2026 09:20:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789723216; cv=none; b=QU9p1DI4qqGRVQVUeT4Vlbizlj2UuUnkQXBRoxY7Na9v0vsaOWdS3L5/pzq4QzZLhtSNKJjFOALsQbnVRH+X7qYqO+wC9SUuLhXtL38H3aJqC+dfNod7S62Gki1Qo/j7QPZCAQbZzO+E2/yE/GzvTBhhe4iYH+tKAOlIIX361Ic= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789723216; c=relaxed/simple; bh=xpxkGsFs2znX7tyIDqWniWwsMv3P7WFY27DlsDXEghg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=WuFozC3DGLnM5pjRTtW/hGOc31YeJjsUXUOIknryu0SX8RRG2ar4OuWpm/UA8XJfnORmEDzUmtdxK9io6xkuAYOkjOIw9WBRZQJ5TPwBJ4jyDvRD7glj55EoYj+U82JNQYtYybqT8gcq0hVV59Irfz0c4pjZJy9KsFdkpqe0J1o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ML/vU9wU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ML/vU9wU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 02F691F000FF; Fri, 18 Sep 2026 09:20:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789723214; bh=rp+rJmhTE7Df7VsQPiO1xXybhrFkjWSbdjcw3UfOXPw=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=ML/vU9wUTiV7IpxrbkVbrPIZCCpeS5W9MCafzrH4LCoogdtHsIhfCx/8jLLzjz65e gpiG8/V3KZVETLi/KYkGLg94yjTjgNPJY4LqxVc4RldYsZPHC72JaXcE3yFEAdprK0 aTLp6m49wnCkhn6XWaAUZG2gKK3XcaTQNehkOAzRJnY04Mg2qZD5Ab5aIYwTDszWr8 b/s+RvHPecLLYqF9THIvZuy0Mka+jhB2Ep2DFQjXD8crxDtyoTNAeYb5oJgpeWHI/Z nrS3jxjehGNm2dBMPqFhSw9I8/Nia46U2gLs683QjkivQmXOm+zOgEiEZ11q9+xMDV 5P4BXDIrfMEfw== From: Christian Brauner Date: Fri, 18 Sep 2026 11:20:00 +0200 Subject: [PATCH 2/2] binfmt_misc: fix racy checks in bpf set_interp kfuncs Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260918-work-binfmt_misc-fixes-v1-2-647b24bc1c46@kernel.org> References: <20260918-work-binfmt_misc-fixes-v1-0-647b24bc1c46@kernel.org> In-Reply-To: <20260918-work-binfmt_misc-fixes-v1-0-647b24bc1c46@kernel.org> To: Chris Mason , linux-fsdevel@vger.kernel.org Cc: Alexander Viro , Jan Kara , linux-mm@kvack.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, "Christian Brauner (Amutable)" X-Mailer: b4 0.17-dev-db0b7 X-Developer-Signature: v=1; a=openpgp-sha256; l=5856; i=brauner@kernel.org; h=from:subject:message-id; bh=Hnw5hxTi5fYqyBdtFSZVwFO8KP68FjOAa84bLk+sgF0=; b=owGbwMvMwCU28Zj0gdSKO4sYT6slMWStZXK7MefV3Irf6m2zfdU2vZjKuFwiQXpHo6pWacSVT 8kzz1rKdZSyMIhxMciKKbI4tJuEyy3nqdhslKkBM4eVCWQIAxenAEwkcwPD/9Bjil6fOJYoFi7i yZvykt9i04GknBuCl3yXfTBYfHqHJgvD/7CN8T8lLZ4x/1wQ1t/x0cj/ZFF0sX3JAvf0ouo+7rK /nAA= X-Developer-Key: i=brauner@kernel.org; a=openpgp; fpr=4880B8C9BD0E5106FC070F4F7B3C391EFEA93624 From: Chris Mason bpf_binprm_set_interp() tests path[0] !=3D '/' on the buffer its load program passes and then reads the same buffer again to copy it with kmemdup_nul(). The buffer can be a BPF map value that another CPU rewrites between the two reads. If byte 0 is overwritten in that window, the kfunc stages a relative or empty interpreter path. The staged path is not checked again, so open_exec() resolves a relative path against the working directory of the task doing the exec. bpf_binprm_set_interp_arg() has the same pattern for its "!len" test and can stage an empty argument, which the interpreter then receives as an empty argv entry. The verifier checks the path and path__sz pair with BPF_READ | BPF_WRITE, so a writable array map value is an accepted argument. bpf(BPF_MAP_UPDATE_ELEM) on an array map copies the new value over the old one in place and takes no lock. Both kfuncs are KF_SLEEPABLE and allocate with GFP_KERNEL between the test and the copy, so the task can sleep inside the window: load program bpf(BPF_MAP_UPDATE_ELEM) bpf_binprm_set_interp() strnlen(path, path__sz) path[0] !=3D '/' is false kmemdup_nul(path, len, GFP_KERNEL) allocation may sleep array_map_update_elem() copy_map_value() rewrites byte 0 copy reads path again bm_bpf_stage_selection() The test in the load program's column proves what byte 0 held only at the moment the test ran. The map update takes no lock, so it can store to byte 0 right after. kmemdup_nul() then copies the rewritten bytes, and bm_bpf_stage_selection() publishes them as bprm->bpf_interp. The staged path is not checked again on its way to open_exec(): load_misc_binary() entry_select_interpreter() returns bprm->bpf_interp unchanged build_interp_argv() copy_string_kernel() copies it as argv[0] bprm_change_interp() kstrdup() entry_open_interpreter() open_exec() unless a bound file is staged or the entry is an 'F' entry None of these functions tests the first byte, and load_misc_binary() hands the pointer to nothing else. In bpf_binprm_set_interp_arg(), strnlen() finds a non-zero len, a NUL is then stored to byte 0, and build_interp_argv() later copies the empty bprm->bpf_interp_arg with copy_string_kernel(). The handler's own load program has to pass a writable map value, and something has to store into it while the kfunc runs. The allocation can sleep inside the window, and with a BPF_F_MMAPABLE array the store is a plain user space write into the mapped value, so a loop can hit it without a single bpf() call. Check the private copy in both kfuncs, so that the string that gets staged is the string that was checked. bpf_binprm_select_interp() already looks its name up in a private copy for the same reason. The remaining tests work on path__sz, arg__sz or the local len, and the copy length is len, so the copy stays inside the extent the verifier checked. Results of bpf_binprm_set_interp() with the check on the copy: - A NUL stored to byte 0 fails interp[0] !=3D '/' and gets -EINVAL. - For len =3D=3D 0, kmemdup_nul() returns an empty string, so an empty path still gets -EINVAL. - A NUL stored further into the string only shortens it to another absolute path, or another non-empty argument, that the program could have passed anyway. - A path that both lacks the leading '/' and is PATH_MAX or longer now gets -ENAMETOOLONG instead of -EINVAL. - A path that is empty or lacks the leading '/' is now rejected after the copy rather than before it, so such a call makes an allocation and returns -ENOMEM instead of -EINVAL if that allocation fails. bpf_binprm_set_interp_arg() still rejects an empty argument before allocating, so its results are unchanged apart from the raced case fixed here. Both new checks run before the previously staged string is freed or replaced. A failing call frees only its own allocation and leaves the earlier selection in place, as the -ENOMEM path already does. Fixes: b4bfe2f6b011 ("binfmt_misc: add binfmt_misc_ops bpf struct_ops") Signed-off-by: Chris Mason Signed-off-by: Christian Brauner (Amutable) Acked-by: Kumar Kartikeya Dwivedi --- fs/binfmt_misc_bpf.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/fs/binfmt_misc_bpf.c b/fs/binfmt_misc_bpf.c index ce1bc78e8511..a3e26e8a4027 100644 --- a/fs/binfmt_misc_bpf.c +++ b/fs/binfmt_misc_bpf.c @@ -141,8 +141,6 @@ __bpf_kfunc int bpf_binprm_set_interp(struct linux_binp= rm *bprm, len =3D strnlen(path, path__sz); if (len =3D=3D path__sz) return -EINVAL; - if (path[0] !=3D '/') - return -EINVAL; if (len >=3D PATH_MAX) return -ENAMETOOLONG; =20 @@ -150,6 +148,15 @@ __bpf_kfunc int bpf_binprm_set_interp(struct linux_bin= prm *bprm, if (!interp) return -ENOMEM; =20 + /* + * The program may pass memory that is written to while this runs, + * so check the private copy and not the buffer it was made from. + */ + if (interp[0] !=3D '/') { + kfree(interp); + return -EINVAL; + } + bm_bpf_stage_selection(bprm, interp, NULL); return 0; } @@ -241,6 +248,15 @@ __bpf_kfunc int bpf_binprm_set_interp_arg(struct linux= _binprm *bprm, if (!val) return -ENOMEM; =20 + /* + * The program may pass memory that is written to while this runs, + * so check the private copy and not the buffer it was made from. + */ + if (!val[0]) { + kfree(val); + return -EINVAL; + } + kfree(bprm->bpf_interp_arg); bprm->bpf_interp_arg =3D val; return 0; --=20 2.53.0