diff --git a/kernel/sucompat.c b/kernel/sucompat.c index bf0c34d3..854e1576 100644 --- a/kernel/sucompat.c +++ b/kernel/sucompat.c @@ -161,8 +161,25 @@ int ksu_handle_execve_sucompat(int *fd, const char __user **filename_user, if (unlikely(!filename_user)) return 0; - memset(path, 0, sizeof(path)); - ksu_strncpy_from_user_nofault(path, *filename_user, sizeof(path)); + /* + * nofault variant fails silently due to pagefault_disable + * some cpus dont really have that good speculative execution + * access_ok to substitute set_fs, we check if pointer is accessible + */ +#if LINUX_VERSION_CODE < KERNEL_VERSION(5,0,0) + if (!access_ok(VERIFY_READ, *filename_user, sizeof(path))) + return 0; +#else + if (!access_ok(*filename_user, sizeof(path))) + return 0; +#endif + // success = returns number of bytes and should be less than path + long len = strncpy_from_user(path, *filename_user, sizeof(path)); + if (len <= 0) + return 0; + + // strncpy_from_user_nofault does this too + path[sizeof(path) - 1] = '\0'; if (likely(memcmp(path, su, sizeof(su)))) return 0;