From: sunfish-a16-rom local integration
Subject: [PATCH] exec: avoid filename use-after-free in ReSukiSU post hook

Applies to our existing manual-hook integration, not pristine LineageOS.
__do_execve_file() consumes filename, including putname() on return paths.
The current wrapper then passes the freed object to a helper that reads
filename->name. Call ReSukiSU's post handler directly with NULL instead;
that handler explicitly accepts missing arguments for its LSM adapter.

Reference: ReSukiSU 6d674e50a022a85076dcfe4498af9a8bfead2cf9,
kernel/feature/sucompat.c (ksu_handle_post_execve and post_execveat).
This fixes a source-level lifetime defect; no boot-panic causality claimed.
Prepared during the DEBUG build without modifying the live build inputs.

--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1885,7 +1885,7 @@
 extern int ksu_handle_execveat(int *fd, struct filename **filename_ptr,
 				void *argv, void *envp, int *flags);
 __attribute__((hot))
-extern int ksu_handle_post_execveat(int *fd, struct filename **filename_ptr,
+extern int ksu_handle_post_execve(int *fd, const char *filename,
 				void *argv, void *envp, int *flags, int *retval);
 #endif
 
@@ -1898,7 +1898,11 @@
 	int retval;
 	ksu_handle_execveat(&fd, &filename, &argv, &envp, &flags);
 	retval = __do_execve_file(fd, filename, argv, envp, flags, NULL);
-	ksu_handle_post_execveat(&fd, &filename, &argv, &envp, &flags, &retval);
+	/* __do_execve_file() already released filename on success and failure.
+	 * The ReSukiSU post hook accepts NULL filename (also used by its LSM
+	 * adapter); do not dereference the freed struct filename wrapper.
+	 */
+	ksu_handle_post_execve(&fd, NULL, &argv, &envp, &flags, &retval);
 	return retval;
 #else
 	return __do_execve_file(fd, filename, argv, envp, flags, NULL);