1 files changed, 48 insertions, 33 deletions

diff --git a/fs/exec.c b/fs/exec.c
index b8792a131533..9696bbf0f0b1 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -106,11 +106,17 @@ static inline void put_binfmt(struct linux_binfmt * fmt)
  */
 asmlinkage long sys_uselib(const char __user * library)
 {
-        struct file * file;
+        struct file *file;
         struct nameidata nd;
-        int error;
-
-        error = __user_path_lookup_open(library, LOOKUP_FOLLOW, &nd, FMODE_READ|FMODE_EXEC);
+        char *tmp = getname(library);
+        int error = PTR_ERR(tmp);
+
+        if (!IS_ERR(tmp)) {
+                error = path_lookup_open(AT_FDCWD, tmp,
+                                         LOOKUP_FOLLOW, &nd,
+                                         FMODE_READ|FMODE_EXEC);
+                putname(tmp);
+        }
         if (error)
                 goto out;
 
@@ -118,7 +124,11 @@ asmlinkage long sys_uselib(const char __user * library)
         if (!S_ISREG(nd.path.dentry->d_inode->i_mode))
                 goto exit;
 
-        error = vfs_permission(&nd, MAY_READ | MAY_EXEC);
+        error = -EACCES;
+        if (nd.path.mnt->mnt_flags & MNT_NOEXEC)
+                goto exit;
+
+        error = vfs_permission(&nd, MAY_READ | MAY_EXEC | MAY_OPEN);
         if (error)
                 goto exit;
 
@@ -656,38 +666,43 @@ EXPORT_SYMBOL(setup_arg_pages);
 struct file *open_exec(const char *name)
 {
         struct nameidata nd;
-        int err;
         struct file *file;
+        int err;
 
-        err = path_lookup_open(AT_FDCWD, name, LOOKUP_FOLLOW, &nd, FMODE_READ|FMODE_EXEC);
-        file = ERR_PTR(err);
-
-        if (!err) {
-                struct inode *inode = nd.path.dentry->d_inode;
-                file = ERR_PTR(-EACCES);
-                if (S_ISREG(inode->i_mode)) {
-                        int err = vfs_permission(&nd, MAY_EXEC);
-                        file = ERR_PTR(err);
-                        if (!err) {
-                                file = nameidata_to_filp(&nd,
-                                                        O_RDONLY|O_LARGEFILE);
-                                if (!IS_ERR(file)) {
-                                        err = deny_write_access(file);
-                                        if (err) {
-                                                fput(file);
-                                                file = ERR_PTR(err);
-                                        }
-                                }
-out:
-                                return file;
-                        }
-                }
-                release_open_intent(&nd);
-                path_put(&nd.path);
+        err = path_lookup_open(AT_FDCWD, name, LOOKUP_FOLLOW, &nd,
+                                FMODE_READ|FMODE_EXEC);
+        if (err)
+                goto out;
+
+        err = -EACCES;
+        if (!S_ISREG(nd.path.dentry->d_inode->i_mode))
+                goto out_path_put;
+
+        if (nd.path.mnt->mnt_flags & MNT_NOEXEC)
+                goto out_path_put;
+
+        err = vfs_permission(&nd, MAY_EXEC | MAY_OPEN);
+        if (err)
+                goto out_path_put;
+
+        file = nameidata_to_filp(&nd, O_RDONLY|O_LARGEFILE);
+        if (IS_ERR(file))
+                return file;
+
+        err = deny_write_access(file);
+        if (err) {
+                fput(file);
+                goto out;
         }
-        goto out;
-}
 
+        return file;
+
+ out_path_put:
+        release_open_intent(&nd);
+        path_put(&nd.path);
+ out:
+        return ERR_PTR(err);
+}
 EXPORT_SYMBOL(open_exec);
 
 int kernel_read(struct file *file, unsigned long offset,