The patch titled Subject: umh: fix refcount underflow in fork_usermode_blob(). has been added to the -mm tree. Its filename is umh-fix-refcount-underflow-in-fork_usermode_blob.patch

This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/umh-fix-refcount-underflow-in-fork_... and later at http://ozlabs.org/~akpm/mmotm/broken-out/umh-fix-refcount-underflow-in-fork_...

Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated there every 3-4 working days

------------------------------------------------------ From: Tetsuo Handa penguin-kernel@i-love.sakura.ne.jp Subject: umh: fix refcount underflow in fork_usermode_blob().

Since free_bprm(bprm) always calls allow_write_access(bprm->file) and fput(bprm->file) if bprm->file is set to non-NULL, __do_execve_file() must call deny_write_access(file) and get_file(file) if called from do_execve_file() path. Otherwise, use-after-free access can happen at fput(file) in fork_usermode_blob().

general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC CPU: 3 PID: 4131 Comm: insmod Tainted: G O 5.6.0-rc5+ #978 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019 RIP: 0010:fork_usermode_blob+0xaa/0x190

Link: http://lkml.kernel.org/r/9b846b1f-a231-4f09-8c37-6bfb0d1e7b05@i-love.sakura.... Signed-off-by: Tetsuo Handa penguin-kernel@I-love.SAKURA.ne.jp Fixes: 449325b52b7a6208 ("umh: introduce fork_usermode_blob() helper") Cc: stable@vger.kernel.org [4.18+] Cc: Alexei Starovoitov ast@kernel.org Cc: David S. Miller davem@davemloft.net Cc: Alexander Viro viro@zeniv.linux.org.uk Signed-off-by: Andrew Morton akpm@linux-foundation.org ---

fs/exec.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)

--- a/fs/exec.c~umh-fix-refcount-underflow-in-fork_usermode_blob +++ a/fs/exec.c @@ -1761,11 +1761,17 @@ static int __do_execve_file(int fd, stru check_unsafe_exec(bprm); current->in_execve = 1;

- if (!file) + if (!file) { file = do_open_execat(fd, filename, flags); - retval = PTR_ERR(file); - if (IS_ERR(file)) - goto out_unmark; + retval = PTR_ERR(file); + if (IS_ERR(file)) + goto out_unmark; + } else { + retval = deny_write_access(file); + if (retval) + goto out_unmark; + get_file(file); + }

sched_exec();

_

Patches currently in -mm which might be from penguin-kernel@i-love.sakura.ne.jp are

kernel-hung_taskc-monitor-killed-tasks.patch umh-fix-refcount-underflow-in-fork_usermode_blob.patch