1 files changed, 58 insertions, 68 deletions

diff --git a/fs/exec.c b/fs/exec.c
index c5128fbc9165..895823d0149d 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -53,6 +53,7 @@
 #include <linux/tracehook.h>
 #include <linux/kmod.h>
 #include <linux/fsnotify.h>
+#include <linux/fs_struct.h>
 
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
@@ -68,17 +69,18 @@ int suid_dumpable = 0;
 static LIST_HEAD(formats);
 static DEFINE_RWLOCK(binfmt_lock);
 
-int register_binfmt(struct linux_binfmt * fmt)
+int __register_binfmt(struct linux_binfmt * fmt, int insert)
 {
         if (!fmt)
                 return -EINVAL;
         write_lock(&binfmt_lock);
-        list_add(&fmt->lh, &formats);
+        insert ? list_add(&fmt->lh, &formats) :
+                 list_add_tail(&fmt->lh, &formats);
         write_unlock(&binfmt_lock);
         return 0;       
 }
 
-EXPORT_SYMBOL(register_binfmt);
+EXPORT_SYMBOL(__register_binfmt);
 
 void unregister_binfmt(struct linux_binfmt * fmt)
 {
@@ -103,40 +105,28 @@ static inline void put_binfmt(struct linux_binfmt * fmt)
 SYSCALL_DEFINE1(uselib, const char __user *, library)
 {
         struct file *file;
-        struct nameidata nd;
         char *tmp = getname(library);
         int error = PTR_ERR(tmp);
 
-        if (!IS_ERR(tmp)) {
-                error = path_lookup_open(AT_FDCWD, tmp,
-                                         LOOKUP_FOLLOW, &nd,
-                                         FMODE_READ|FMODE_EXEC);
-                putname(tmp);
-        }
-        if (error)
+        if (IS_ERR(tmp))
+                goto out;
+
+        file = do_filp_open(AT_FDCWD, tmp,
+                                O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
+                                MAY_READ | MAY_EXEC | MAY_OPEN);
+        putname(tmp);
+        error = PTR_ERR(file);
+        if (IS_ERR(file))
                 goto out;
 
         error = -EINVAL;
-        if (!S_ISREG(nd.path.dentry->d_inode->i_mode))
+        if (!S_ISREG(file->f_path.dentry->d_inode->i_mode))
                 goto exit;
 
         error = -EACCES;
-        if (nd.path.mnt->mnt_flags & MNT_NOEXEC)
+        if (file->f_path.mnt->mnt_flags & MNT_NOEXEC)
                 goto exit;
 
-        error = inode_permission(nd.path.dentry->d_inode,
-                                 MAY_READ | MAY_EXEC | MAY_OPEN);
-        if (error)
-                goto exit;
-        error = ima_path_check(&nd.path, MAY_READ | MAY_EXEC | MAY_OPEN);
-        if (error)
-                goto exit;
-
-        file = nameidata_to_filp(&nd, O_RDONLY|O_LARGEFILE);
-        error = PTR_ERR(file);
-        if (IS_ERR(file))
-                goto out;
-
         fsnotify_open(file->f_path.dentry);
 
         error = -ENOEXEC;
@@ -158,13 +148,10 @@ SYSCALL_DEFINE1(uselib, const char __user *, library)
                 }
                 read_unlock(&binfmt_lock);
         }
+exit:
         fput(file);
 out:
         return error;
-exit:
-        release_open_intent(&nd);
-        path_put(&nd.path);
-        goto out;
 }
 
 #ifdef CONFIG_MMU
@@ -659,47 +646,33 @@ EXPORT_SYMBOL(setup_arg_pages);
 
 struct file *open_exec(const char *name)
 {
-        struct nameidata nd;
         struct file *file;
         int err;
 
-        err = path_lookup_open(AT_FDCWD, name, LOOKUP_FOLLOW, &nd,
-                                FMODE_READ|FMODE_EXEC);
-        if (err)
+        file = do_filp_open(AT_FDCWD, name,
+                                O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
+                                MAY_EXEC | MAY_OPEN);
+        if (IS_ERR(file))
                 goto out;
 
         err = -EACCES;
-        if (!S_ISREG(nd.path.dentry->d_inode->i_mode))
-                goto out_path_put;
-
-        if (nd.path.mnt->mnt_flags & MNT_NOEXEC)
-                goto out_path_put;
-
-        err = inode_permission(nd.path.dentry->d_inode, MAY_EXEC | MAY_OPEN);
-        if (err)
-                goto out_path_put;
-        err = ima_path_check(&nd.path, MAY_EXEC | MAY_OPEN);
-        if (err)
-                goto out_path_put;
+        if (!S_ISREG(file->f_path.dentry->d_inode->i_mode))
+                goto exit;
 
-        file = nameidata_to_filp(&nd, O_RDONLY|O_LARGEFILE);
-        if (IS_ERR(file))
-                return file;
+        if (file->f_path.mnt->mnt_flags & MNT_NOEXEC)
+                goto exit;
 
         fsnotify_open(file->f_path.dentry);
 
         err = deny_write_access(file);
-        if (err) {
-                fput(file);
-                goto out;
-        }
+        if (err)
+                goto exit;
 
+out:
         return file;
 
- out_path_put:
-        release_open_intent(&nd);
-        path_put(&nd.path);
- out:
+exit:
+        fput(file);
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL(open_exec);
@@ -1056,28 +1029,35 @@ EXPORT_SYMBOL(install_exec_creds);
  * - the caller must hold current->cred_exec_mutex to protect against
  *   PTRACE_ATTACH
  */
-void check_unsafe_exec(struct linux_binprm *bprm)
+int check_unsafe_exec(struct linux_binprm *bprm)
 {
         struct task_struct *p = current, *t;
-        unsigned long flags;
-        unsigned n_fs, n_sighand;
+        unsigned n_fs;
+        int res = 0;
 
         bprm->unsafe = tracehook_unsafe_exec(p);
 
         n_fs = 1;
-        n_sighand = 1;
-        lock_task_sighand(p, &flags);
+        write_lock(&p->fs->lock);
+        rcu_read_lock();
         for (t = next_thread(p); t != p; t = next_thread(t)) {
                 if (t->fs == p->fs)
                         n_fs++;
-                n_sighand++;
         }
+        rcu_read_unlock();
 
-        if (atomic_read(&p->fs->count) > n_fs ||
-            atomic_read(&p->sighand->count) > n_sighand)
+        if (p->fs->users > n_fs) {
                 bprm->unsafe |= LSM_UNSAFE_SHARE;
+        } else {
+                res = -EAGAIN;
+                if (!p->fs->in_exec) {
+                        p->fs->in_exec = 1;
+                        res = 1;
+                }
+        }
+        write_unlock(&p->fs->lock);
 
-        unlock_task_sighand(p, &flags);
+        return res;
 }
 
 /* 
@@ -1276,6 +1256,7 @@ int do_execve(char * filename,
         struct linux_binprm *bprm;
         struct file *file;
         struct files_struct *displaced;
+        bool clear_in_exec;
         int retval;
 
         retval = unshare_files(&displaced);
@@ -1296,12 +1277,16 @@ int do_execve(char * filename,
         bprm->cred = prepare_exec_creds();
         if (!bprm->cred)
                 goto out_unlock;
-        check_unsafe_exec(bprm);
+
+        retval = check_unsafe_exec(bprm);
+        if (retval < 0)
+                goto out_unlock;
+        clear_in_exec = retval;
 
         file = open_exec(filename);
         retval = PTR_ERR(file);
         if (IS_ERR(file))
-                goto out_unlock;
+                goto out_unmark;
 
         sched_exec();
 
@@ -1344,6 +1329,7 @@ int do_execve(char * filename,
                 goto out;
 
         /* execve succeeded */
+        current->fs->in_exec = 0;
         current->in_execve = 0;
         mutex_unlock(&current->cred_exec_mutex);
         acct_update_integrals(current);
@@ -1362,6 +1348,10 @@ out_file:
                 fput(bprm->file);
         }
 
+out_unmark:
+        if (clear_in_exec)
+                current->fs->in_exec = 0;
+
 out_unlock:
         current->in_execve = 0;
         mutex_unlock(&current->cred_exec_mutex);