From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f48.google.com (mail-ot1-f48.google.com [209.85.210.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85AB12DF15C for ; Tue, 23 Jun 2026 18:49:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782240594; cv=none; b=f0RNBTlAYXzRwHL2witbuvlLrhBwqgaC0Rpfvei7sFL7z9aOa8q7u66DfpVxA+u5D+1XnGm2/i2HcTvymfZp3G2KunZAf7yZUwB2/T+6zW6G0fGQP3bKzDiJ7Bj0m2JWP/000CYMd0B6CvuaTnR2x78OfG/iYNx7BRM2S1F2gaI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782240594; c=relaxed/simple; bh=r39Mt+ANrVo8Nbce/0cqQMUz6OdLFlk+s9jJdmvyYt8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=LdvE8DcPZHtyrCXiE7kxhwY0hJbE3CohY6ZZ8KQsgiogsXsIXXuqTMYXitGcxpSd1BQQF1cvW4f/mpI+C+dk5aEwhFeW9I98Cv1vBD6vsf5zt800OKA4l0gsFJ8ubxhgLu25l/9gS6DXzJFxfwm/10Gdn/KFC+Da/cina8uii/U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=J0TMH9QD; arc=none smtp.client-ip=209.85.210.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="J0TMH9QD" Received: by mail-ot1-f48.google.com with SMTP id 46e09a7af769-7e9483cd614so168293a34.1 for ; Tue, 23 Jun 2026 11:49:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782240591; x=1782845391; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=dgjDRIkuwemtsHS+Lw2hf5LtPo2akVKj+nFoMASDyFA=; b=J0TMH9QDwAlAuXIhySz0g/nLVQYetQ/g4p8ZhB1nknWXHVE5eoTjEt4i44XTnxA1yK xdT2A1Yf6l2v/F9M9J799Ba23KGBliSe88tqee+VDYNqCnxX9B+aNN4/h9+ekhLYN81l v0muO4aCv77hnW8Q/KLLIFhV2I1a5cAZ1dG5f+a7nJZTaYBE585WHe1Xy/o1/Ub01Zxz /J5QBA3Sby0A+2roF5DoYr8UTE0U2JaF5aBXqjJ5TJvsd+Ly1bg8rus3T33VuYkd/0f7 E4ostdfFCsLrALZ339SRXvecYP+nXIxLTmFjRUQnlN4iahXDMqEb46zr0RUvkIskkyh+ AeEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782240591; x=1782845391; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=dgjDRIkuwemtsHS+Lw2hf5LtPo2akVKj+nFoMASDyFA=; b=Rgz+jsBdef7YTpF4dsX/AC+3z1XSSvlcUyHIZqCMlx8CeF84w4WZQw7FXVUQ1j8x4A 0ar/gWnsqFIqsVlj0zD/1cvZNxLalOb8xU83Qq6rV4Q0z6WAcaQa4cLDKyWGDnkInjB8 uOwtWQrZjl/+neVviVIEy7xtGpsYF1qpXrCqLw/sJ4pR/8/3rUR9Zkl65D9WzLkxB3SZ B0oD6apNx9FxCv8kyyw+FqanC5/BiqtQLSzwdWy0Gz4namZuoBO8/G9VeDXMAegAcvRu X7OJUn0YzdmHTEOd/gJ+482BbI1FO2/etRLMSexG2vFMHbM+CspnMBgA+bWtkMyhIopL xP6g== X-Forwarded-Encrypted: i=1; AFNElJ8gXQgoCnmZBgMchbIG1vRNp46r+zW+pLut3YrMEtdtAlEGHPUt/Wy5R6/qcDriGHLkyIGOyc30X2+fYhc=@vger.kernel.org X-Gm-Message-State: AOJu0YxGP8Ndg3KrRrqPmPolctt6ZLmF9a3NATbKnN+UEgjKzU18jzNE tld0hhEpNyTIfaj/vGbTA/8pDaRLYRx2o8oLfc8axrIIvNtcgnGcIV41 X-Gm-Gg: AfdE7cmbDLRy4qhAVd+Txucy3bhHZ+Ya63eHU+hADHMuqKa83PtidRb2cq9RIEaOFr9 BTrqxmZLmzL+HU5MzZlAULG+r4pecyxNbePAiK147bdp1tiA1rntusccODN6Jy76COtfnOHvZ6a bVCVUIFVwra/8JBjW/b9rCAOhFphlMGT0SpuVjfDoXHj7fVTZRVumVqhOcQqrO/LO087RUd+wAF 2gNcqHpUCCxhuUbqKT9KG3sfbXmUNUNnzxINOtjp7v6JCMKMR9Ir87g48tYjV73dL2gmETeHtVI n+G+3KeuD7Re+IP2bdeVZHmuhhdaZRUujGeb/RsJxWUc7wFiCxaZ6f+bgN7+3oUbM7grn6q5M8+ NSo4pkL8pY+fg/ZtEh5VtAGkDEgLf0FIoAbVhCoyffY/D5AQ48Oo5MUzhf+MVEIb/BBcFWWIun7 zpeq2AYUX3DQzaD0X8lreohd/knnwCsTDf X-Received: by 2002:a05:6830:1209:b0:7e6:441:cb4d with SMTP id 46e09a7af769-7e973fec850mr2233935a34.3.1782240591419; Tue, 23 Jun 2026 11:49:51 -0700 (PDT) Received: from alan-QEMU-Virtual-Machine ([153.67.119.177]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7e94429a5bdsm10119161a34.22.2026.06.23.11.49.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Jun 2026 11:49:51 -0700 (PDT) From: Alan Urmancheev To: Kees Cook Cc: linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, trivial@kernel.org, Alan Urmancheev Subject: [PATCH] exec: fix off-by-one in binfmt max rewrite depth comment Date: Tue, 23 Jun 2026 01:23:22 -0400 Message-ID: <20260623052322.74711-1-alan.urman@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The loop in exec_binprm() permits depth values 0 through 5, up to 5 successive binfmt rewrites (setting bprm->interpreter) until the 6th one would fail on depth > 5 and return -ELOOP. The comment claimed 4 levels, which was wrong. Adjusting the code to allow only 4 rewrites would be breaking userland, so fix the comment and not the code. Reproducer (a chain of shebanged scripts followed by an ELF binary): #!/bin/sh tmp=$(mktemp -d) echo $tmp cd $tmp mk () { echo $2 > $1; chmod +x $1; } for i in $(seq 4); do mk $i "#!$((i + 1))" done mk 5 '#!/bin/true' ./1 && echo '5 binfmt rewrites OK (1 -> 2 -> 3 -> 4 -> 5 -> /bin/true)' mk 5 '#!6' mk 6 '#!/bin/true' ./1 || echo '6 binfmt rewrites KO (1 -> 2 -> 3 -> 4 -> 5 -> 6 -> /bin/true)' Signed-off-by: Alan Urmancheev --- fs/exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/exec.c b/fs/exec.c index b92fe7db1..d5993cedc 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1717,7 +1717,7 @@ static int exec_binprm(struct linux_binprm *bprm) old_vpid = task_pid_nr_ns(current, task_active_pid_ns(current->parent)); rcu_read_unlock(); - /* This allows 4 levels of binfmt rewrites before failing hard. */ + /* This allows 5 levels of binfmt rewrites before failing hard. */ for (depth = 0;; depth++) { struct file *exec; if (depth > 5) -- 2.53.0