exec: fix set_binfmt() vs sys_delete_module() race

sys_delete_module() can set MODULE_STATE_GOING after
search_binary_handler() does try_module_get().  In this case
set_binfmt()->try_module_get() fails but since none of the callers
check the returned error, the task will run with the wrong old
->binfmt.

The proper fix should change all ->load_binary() methods, but we can
rely on fact that the caller must hold a reference to binfmt->module
and use __module_get() which never fails.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Rusty Russell <rusty@rustcorp.com.au>
Cc: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>
Cc: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 5 insertions, 9 deletions

diff --git a/fs/exec.c b/fs/exec.c
index 8efbdc606a1e..6dc92c39dd94 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1395,18 +1395,14 @@ out_ret:
         return retval;
 }
 
-int set_binfmt(struct linux_binfmt *new)
+void set_binfmt(struct linux_binfmt *new)
 {
-        struct linux_binfmt *old = current->binfmt;
+        if (current->binfmt)
+                module_put(current->binfmt->module);
 
-        if (new) {
-                if (!try_module_get(new->module))
-                        return -1;
-        }
         current->binfmt = new;
-        if (old)
-                module_put(old->module);
-        return 0;
+        if (new)
+                __module_get(new->module);
 }
 
 EXPORT_SYMBOL(set_binfmt);