summaryrefslogtreecommitdiffstats
path: root/fs/exec.c
diff options
context:
space:
mode:
authorOleg Nesterov <oleg@redhat.com>2009-09-23 15:56:59 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2009-09-24 07:21:01 -0700
commit964ee7df90d799e38fb1556c57cd5c45fc736436 (patch)
tree58ae7325f80394cb86409d5876c710376dde8e1a /fs/exec.c
parent61be228a06dc6e8662f30e89eda3c12083c1f379 (diff)
downloadlinux-964ee7df90d799e38fb1556c57cd5c45fc736436.tar.gz
linux-964ee7df90d799e38fb1556c57cd5c45fc736436.tar.bz2
linux-964ee7df90d799e38fb1556c57cd5c45fc736436.zip
exec: fix set_binfmt() vs sys_delete_module() race
sys_delete_module() can set MODULE_STATE_GOING after search_binary_handler() does try_module_get(). In this case set_binfmt()->try_module_get() fails but since none of the callers check the returned error, the task will run with the wrong old ->binfmt. The proper fix should change all ->load_binary() methods, but we can rely on fact that the caller must hold a reference to binfmt->module and use __module_get() which never fails. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Rusty Russell <rusty@rustcorp.com.au> Cc: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com> Cc: Roland McGrath <roland@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/exec.c')
-rw-r--r--fs/exec.c14
1 files changed, 5 insertions, 9 deletions
diff --git a/fs/exec.c b/fs/exec.c
index 8efbdc606a1e..6dc92c39dd94 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1395,18 +1395,14 @@ out_ret:
return retval;
}
-int set_binfmt(struct linux_binfmt *new)
+void set_binfmt(struct linux_binfmt *new)
{
- struct linux_binfmt *old = current->binfmt;
+ if (current->binfmt)
+ module_put(current->binfmt->module);
- if (new) {
- if (!try_module_get(new->module))
- return -1;
- }
current->binfmt = new;
- if (old)
- module_put(old->module);
- return 0;
+ if (new)
+ __module_get(new->module);
}
EXPORT_SYMBOL(set_binfmt);