Hi Linus, This contains a single urgent fix for copy_process() in kernel/fork.c:
The following changes since commit 6fbc7275c7a9ba97877050335f290341a1fd8dbf: Linux 5.2-rc7 (2019-06-30 11:25:36 +0800) are available in the Git repository at: [email protected]:pub/scm/linux/kernel/git/brauner/linux tags/for-linus-20190701 for you to fetch changes up to 28dd29c06d0dede4b32b2c559cff21955a830928: fork: return proper negative error code (2019-07-01 16:43:30 +0200) With Al's removal of ksys_close() from cleanup paths in copy_process() a bug was introduced. When anon_inode_getfile() failed the cleanup was correctly performed but the error code was not propagated to callers of copy_process() causing them to operate on a nonsensical pointer. The fix is a simple on-liner which makes sure that a proper negative error code is returned from copy_process(). syzkaller has also verified that the bug is not reproducible with the patch in this branch. Please consider pulling these changes from the signed for-linus-20190701 tag. Thanks! Christian ---------------------------------------------------------------- for-linus-20190701 ---------------------------------------------------------------- Christian Brauner (1): fork: return proper negative error code kernel/fork.c | 1 + 1 file changed, 1 insertion(+)
