exec: remove argv_len from struct linux_binprm

175a06ae · Tetsuo Handa <[email protected]> · 2008-04-29 00:59:17 -07:00

I noticed that 2.6.24.2 calculates bprm->argv_len at do_execve().  But it
doesn't update bprm->argv_len after "remove_arg_zero() +
copy_strings_kernel()" at load_script() etc.

audit_bprm() is called from search_binary_handler() and
search_binary_handler() is called from load_script() etc.  Thus, I think the
condition check

  if (bprm->argv_len > (audit_argv_kb << 10))
          return -E2BIG;

in audit_bprm() might return wrong result when strlen(removed_arg) !=
strlen(spliced_args).  Why not update bprm->argv_len at load_script() etc.  ?

By the way, 2.6.25-rc3 seems to not doing the condition check.  Is the field
bprm->argv_len no longer needed?

Signed-off-by: Tetsuo Handa <[email protected]>
Cc: Ollie Wild <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Commit: 175a06ae300188af8a61db68a78e1af44dc7d44f
Parents: ecd0fa98

Changes

2 files changed · +0 −4

File	Status	Add	Del	Content
fs/exec.c	modified	+0	−3	View file
include/linux/binfmts.h	modified	+0	−1	View file

fs/exec.c

View file

diff --git a/fs/exec.c b/fs/exec.c
index b152029..7768453 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1268,7 +1268,6 @@ int do_execve(char * filename,
 {
 	struct linux_binprm *bprm;
 	struct file *file;
-	unsigned long env_p;
 	struct files_struct *displaced;
 	int retval;
 
@@ -1321,11 +1320,9 @@ int do_execve(char * filename,
 	if (retval < 0)
 		goto out;
 
-	env_p = bprm->p;
 	retval = copy_strings(bprm->argc, argv, bprm);
 	if (retval < 0)
 		goto out;
-	bprm->argv_len = env_p - bprm->p;
 
 	retval = search_binary_handler(bprm,regs);
 	if (retval >= 0) {

include/linux/binfmts.h

View file

diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index b7fc55e..1dd7567 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -48,7 +48,6 @@ struct linux_binprm{
 	unsigned interp_flags;
 	unsigned interp_data;
 	unsigned long loader, exec;
-	unsigned long argv_len;
 };
 
 #define BINPRM_FLAGS_ENFORCE_NONDUMP_BIT 0