sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
39 lines
1.7 KiB
Diff
39 lines
1.7 KiB
Diff
From: sunfish-a16-rom local integration
|
|
Subject: [PATCH] exec: avoid filename use-after-free in ReSukiSU post hook
|
|
|
|
Applies to our existing manual-hook integration, not pristine LineageOS.
|
|
__do_execve_file() consumes filename, including putname() on return paths.
|
|
The current wrapper then passes the freed object to a helper that reads
|
|
filename->name. Call ReSukiSU's post handler directly with NULL instead;
|
|
that handler explicitly accepts missing arguments for its LSM adapter.
|
|
|
|
Reference: ReSukiSU 6d674e50a022a85076dcfe4498af9a8bfead2cf9,
|
|
kernel/feature/sucompat.c (ksu_handle_post_execve and post_execveat).
|
|
This fixes a source-level lifetime defect; no boot-panic causality claimed.
|
|
Prepared during the DEBUG build without modifying the live build inputs.
|
|
|
|
--- a/fs/exec.c
|
|
+++ b/fs/exec.c
|
|
@@ -1885,7 +1885,7 @@
|
|
extern int ksu_handle_execveat(int *fd, struct filename **filename_ptr,
|
|
void *argv, void *envp, int *flags);
|
|
__attribute__((hot))
|
|
-extern int ksu_handle_post_execveat(int *fd, struct filename **filename_ptr,
|
|
+extern int ksu_handle_post_execve(int *fd, const char *filename,
|
|
void *argv, void *envp, int *flags, int *retval);
|
|
#endif
|
|
|
|
@@ -1898,7 +1898,11 @@
|
|
int retval;
|
|
ksu_handle_execveat(&fd, &filename, &argv, &envp, &flags);
|
|
retval = __do_execve_file(fd, filename, argv, envp, flags, NULL);
|
|
- ksu_handle_post_execveat(&fd, &filename, &argv, &envp, &flags, &retval);
|
|
+ /* __do_execve_file() already released filename on success and failure.
|
|
+ * The ReSukiSU post hook accepts NULL filename (also used by its LSM
|
|
+ * adapter); do not dereference the freed struct filename wrapper.
|
|
+ */
|
|
+ ksu_handle_post_execve(&fd, NULL, &argv, &envp, &flags, &retval);
|
|
return retval;
|
|
#else
|
|
return __do_execve_file(fd, filename, argv, envp, flags, NULL);
|