exec: fix set_binfmt() vs sys_delete_module() race (964ee7df) · Commits · 戴 / test

sys_delete_module() can set MODULE_STATE_GOING after search_binary_handler() does try_module_get(). In this case set_binfmt()->try_module_get() fails but since none of the callers check the returned error, the task will run with the wrong old ->binfmt. The proper fix should change all ->load_binary() methods, but we can rely on fact that the caller must hold a reference to binfmt->module and use __module_get() which never fails. Signed-off-by:

Oleg Nesterov <oleg@redhat.com> Acked-by:

Rusty Russell <rusty@rustcorp.com.au> Cc: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com> Cc: Roland McGrath <roland@redhat.com> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

fs/exec.c

+5 −9

Original line number	Diff line number	Diff line
		@@ -1395,18 +1395,14 @@ out_ret:
		return retval;
		}

		int set_binfmt(struct linux_binfmt *new)
		void set_binfmt(struct linux_binfmt *new)
		{
		struct linux_binfmt *old = current->binfmt;
		if (current->binfmt)
		module_put(current->binfmt->module);

		if (new) {
		if (!try_module_get(new->module))
		return -1;
		}
		current->binfmt = new;
		if (old)
		module_put(old->module);
		return 0;
		if (new)
		__module_get(new->module);
		}

		EXPORT_SYMBOL(set_binfmt);

include/linux/binfmts.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -120,7 +120,7 @@ extern int copy_strings_kernel(int argc,char ** argv,struct linux_binprm *bprm);
		extern int prepare_bprm_creds(struct linux_binprm *bprm);
		extern void install_exec_creds(struct linux_binprm *bprm);
		extern void do_coredump(long signr, int exit_code, struct pt_regs *regs);
		extern int set_binfmt(struct linux_binfmt *new);
		extern void set_binfmt(struct linux_binfmt *new);
		extern void free_bprm(struct linux_binprm *);

		#endif /* __KERNEL__ */

Admin message