Kees Cook 67c6777a5d binfmt_elf: safely increment argv pointers
When building the argv/envp pointers, the envp is needlessly
pre-incremented instead of just continuing after the argv pointers are
finished.  In some (likely impossible) race where the strings could be
changed from userspace between copy_strings() and here, it might be
possible to confuse the envp position.  Instead, just use sp like
everything else.

Link: http://lkml.kernel.org/r/20170622173838.GA43308@beast
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Daniel Micay <danielmicay@gmail.com>
Cc: Qualys Security Advisory <qsa@qualys.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Dmitry Safonov <dsafonov@virtuozzo.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Grzegorz Andrejczuk <grzegorz.andrejczuk@intel.com>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-07-10 16:32:36 -07:00
..
2017-05-05 15:24:52 -04:00
2017-07-09 14:40:12 -07:00
2017-05-12 15:57:15 -07:00
2017-06-14 19:37:23 +02:00
2017-07-06 16:24:35 -07:00
2017-07-07 20:09:10 -04:00
2017-07-03 09:55:26 -07:00
2017-06-27 17:02:36 -07:00
2017-07-10 10:51:53 -07:00
2017-04-17 12:52:27 -04:00
2017-07-07 19:38:17 -07:00
2017-07-07 13:48:18 -07:00
2017-07-10 10:51:53 -07:00
2017-06-22 11:44:55 -04:00
2017-05-08 17:15:12 -07:00
2017-06-09 16:28:01 -04:00
2017-07-05 18:44:23 -04:00