Merge commit 'v2.6.30' into for-2.6.31

[safe/jmp/linux-2.6] / fs / exec.c

diff --git a/fs/exec.c b/fs/exec.c
index c5128fb..895823d 100644 (file)
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -53,6 +53,7 @@
 #include <linux/tracehook.h>
 #include <linux/kmod.h>
 #include <linux/fsnotify.h>
+#include <linux/fs_struct.h>
 
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
@@ -68,17 +69,18 @@ int suid_dumpable = 0;
 static LIST_HEAD(formats);
 static DEFINE_RWLOCK(binfmt_lock);
 
-int register_binfmt(struct linux_binfmt * fmt)
+int __register_binfmt(struct linux_binfmt * fmt, int insert)
 {
        if (!fmt)
                return -EINVAL;
        write_lock(&binfmt_lock);
-       list_add(&fmt->lh, &formats);
+       insert ? list_add(&fmt->lh, &formats) :
+                list_add_tail(&fmt->lh, &formats);
        write_unlock(&binfmt_lock);
        return 0;       
 }
 
-EXPORT_SYMBOL(register_binfmt);
+EXPORT_SYMBOL(__register_binfmt);
 
 void unregister_binfmt(struct linux_binfmt * fmt)
 {
@@ -103,40 +105,28 @@ static inline void put_binfmt(struct linux_binfmt * fmt)
 SYSCALL_DEFINE1(uselib, const char __user *, library)
 {
        struct file *file;
-       struct nameidata nd;
        char *tmp = getname(library);
        int error = PTR_ERR(tmp);
 
-       if (!IS_ERR(tmp)) {
-               error = path_lookup_open(AT_FDCWD, tmp,
-                                        LOOKUP_FOLLOW, &nd,
-                                        FMODE_READ|FMODE_EXEC);
-               putname(tmp);
-       }
-       if (error)
+       if (IS_ERR(tmp))
+               goto out;
+
+       file = do_filp_open(AT_FDCWD, tmp,
+                               O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
+                               MAY_READ | MAY_EXEC | MAY_OPEN);
+       putname(tmp);
+       error = PTR_ERR(file);
+       if (IS_ERR(file))
                goto out;
 
        error = -EINVAL;
-       if (!S_ISREG(nd.path.dentry->d_inode->i_mode))
+       if (!S_ISREG(file->f_path.dentry->d_inode->i_mode))
                goto exit;
 
        error = -EACCES;
-       if (nd.path.mnt->mnt_flags & MNT_NOEXEC)
+       if (file->f_path.mnt->mnt_flags & MNT_NOEXEC)
                goto exit;
 
-       error = inode_permission(nd.path.dentry->d_inode,
-                                MAY_READ | MAY_EXEC | MAY_OPEN);
-       if (error)
-               goto exit;
-       error = ima_path_check(&nd.path, MAY_READ | MAY_EXEC | MAY_OPEN);
-       if (error)
-               goto exit;
-
-       file = nameidata_to_filp(&nd, O_RDONLY|O_LARGEFILE);
-       error = PTR_ERR(file);
-       if (IS_ERR(file))
-               goto out;
-
        fsnotify_open(file->f_path.dentry);
 
        error = -ENOEXEC;
@@ -158,13 +148,10 @@ SYSCALL_DEFINE1(uselib, const char __user *, library)
                }
                read_unlock(&binfmt_lock);
        }
+exit:
        fput(file);
 out:
        return error;
-exit:
-       release_open_intent(&nd);
-       path_put(&nd.path);
-       goto out;
 }
 
 #ifdef CONFIG_MMU
@@ -659,47 +646,33 @@ EXPORT_SYMBOL(setup_arg_pages);
 
 struct file *open_exec(const char *name)
 {
-       struct nameidata nd;
        struct file *file;
        int err;
 
-       err = path_lookup_open(AT_FDCWD, name, LOOKUP_FOLLOW, &nd,
-                               FMODE_READ|FMODE_EXEC);
-       if (err)
+       file = do_filp_open(AT_FDCWD, name,
+                               O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
+                               MAY_EXEC | MAY_OPEN);
+       if (IS_ERR(file))
                goto out;
 
        err = -EACCES;
-       if (!S_ISREG(nd.path.dentry->d_inode->i_mode))
-               goto out_path_put;
-
-       if (nd.path.mnt->mnt_flags & MNT_NOEXEC)
-               goto out_path_put;
-
-       err = inode_permission(nd.path.dentry->d_inode, MAY_EXEC | MAY_OPEN);
-       if (err)
-               goto out_path_put;
-       err = ima_path_check(&nd.path, MAY_EXEC | MAY_OPEN);
-       if (err)
-               goto out_path_put;
+       if (!S_ISREG(file->f_path.dentry->d_inode->i_mode))
+               goto exit;
 
-       file = nameidata_to_filp(&nd, O_RDONLY|O_LARGEFILE);
-       if (IS_ERR(file))
-               return file;
+       if (file->f_path.mnt->mnt_flags & MNT_NOEXEC)
+               goto exit;
 
        fsnotify_open(file->f_path.dentry);
 
        err = deny_write_access(file);
-       if (err) {
-               fput(file);
-               goto out;
-       }
+       if (err)
+               goto exit;
 
+out:
        return file;
 
- out_path_put:
-       release_open_intent(&nd);
-       path_put(&nd.path);
- out:
+exit:
+       fput(file);
        return ERR_PTR(err);
 }
 EXPORT_SYMBOL(open_exec);
@@ -1056,28 +1029,35 @@ EXPORT_SYMBOL(install_exec_creds);
  * - the caller must hold current->cred_exec_mutex to protect against
  *   PTRACE_ATTACH
  */
-void check_unsafe_exec(struct linux_binprm *bprm)
+int check_unsafe_exec(struct linux_binprm *bprm)
 {
        struct task_struct *p = current, *t;
-       unsigned long flags;
-       unsigned n_fs, n_sighand;
+       unsigned n_fs;
+       int res = 0;
 
        bprm->unsafe = tracehook_unsafe_exec(p);
 
        n_fs = 1;
-       n_sighand = 1;
-       lock_task_sighand(p, &flags);
+       write_lock(&p->fs->lock);
+       rcu_read_lock();
        for (t = next_thread(p); t != p; t = next_thread(t)) {
                if (t->fs == p->fs)
                        n_fs++;
-               n_sighand++;
        }
+       rcu_read_unlock();
 
-       if (atomic_read(&p->fs->count) > n_fs ||
-           atomic_read(&p->sighand->count) > n_sighand)
+       if (p->fs->users > n_fs) {
                bprm->unsafe |= LSM_UNSAFE_SHARE;
+       } else {
+               res = -EAGAIN;
+               if (!p->fs->in_exec) {
+                       p->fs->in_exec = 1;
+                       res = 1;
+               }
+       }
+       write_unlock(&p->fs->lock);
 
-       unlock_task_sighand(p, &flags);
+       return res;
 }
 
 /* 
@@ -1276,6 +1256,7 @@ int do_execve(char * filename,
        struct linux_binprm *bprm;
        struct file *file;
        struct files_struct *displaced;
+       bool clear_in_exec;
        int retval;
 
        retval = unshare_files(&displaced);
@@ -1296,12 +1277,16 @@ int do_execve(char * filename,
        bprm->cred = prepare_exec_creds();
        if (!bprm->cred)
                goto out_unlock;
-       check_unsafe_exec(bprm);
+
+       retval = check_unsafe_exec(bprm);
+       if (retval < 0)
+               goto out_unlock;
+       clear_in_exec = retval;
 
        file = open_exec(filename);
        retval = PTR_ERR(file);
        if (IS_ERR(file))
-               goto out_unlock;
+               goto out_unmark;
 
        sched_exec();
 
@@ -1344,6 +1329,7 @@ int do_execve(char * filename,
                goto out;
 
        /* execve succeeded */
+       current->fs->in_exec = 0;
        current->in_execve = 0;
        mutex_unlock(&current->cred_exec_mutex);
        acct_update_integrals(current);
@@ -1362,6 +1348,10 @@ out_file:
                fput(bprm->file);
        }
 
+out_unmark:
+       if (clear_in_exec)
+               current->fs->in_exec = 0;
+
 out_unlock:
        current->in_execve = 0;
        mutex_unlock(&current->cred_exec_mutex);