diff options
author | Oleg Nesterov <oleg@redhat.com> | 2009-09-24 00:56:59 +0200 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-09-24 16:21:01 +0200 |
commit | 964ee7df90d799e38fb1556c57cd5c45fc736436 (patch) | |
tree | 58ae7325f80394cb86409d5876c710376dde8e1a /fs/exec.c | |
parent | exec: allow do_coredump() to wait for user space pipe readers to complete (diff) | |
download | linux-964ee7df90d799e38fb1556c57cd5c45fc736436.tar.xz linux-964ee7df90d799e38fb1556c57cd5c45fc736436.zip |
exec: fix set_binfmt() vs sys_delete_module() race
sys_delete_module() can set MODULE_STATE_GOING after
search_binary_handler() does try_module_get(). In this case
set_binfmt()->try_module_get() fails but since none of the callers
check the returned error, the task will run with the wrong old
->binfmt.
The proper fix should change all ->load_binary() methods, but we can
rely on fact that the caller must hold a reference to binfmt->module
and use __module_get() which never fails.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Cc: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>
Cc: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/exec.c')
-rw-r--r-- | fs/exec.c | 14 |
1 files changed, 5 insertions, 9 deletions
diff --git a/fs/exec.c b/fs/exec.c index 8efbdc606a1e..6dc92c39dd94 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1395,18 +1395,14 @@ out_ret: return retval; } -int set_binfmt(struct linux_binfmt *new) +void set_binfmt(struct linux_binfmt *new) { - struct linux_binfmt *old = current->binfmt; + if (current->binfmt) + module_put(current->binfmt->module); - if (new) { - if (!try_module_get(new->module)) - return -1; - } current->binfmt = new; - if (old) - module_put(old->module); - return 0; + if (new) + __module_get(new->module); } EXPORT_SYMBOL(set_binfmt); |