put_binfmt_handler() closes an F-flag (MISC_FMT_OPEN_FILE) entry's
interpreter file without restoring the write access that open_exec()
denied at registration.  Every register/delete cycle of an F entry
leaks one i_writecount denial on the interpreter's inode, so that
inode returns -ETXTBSY to all writers until it is evicted from the
inode cache or the machine reboots.

The registration error path (add_entry failure) correctly calls
exe_file_allow_write_access() before filp_close(), but the normal
teardown path in put_binfmt_handler() was missing it.

Fix by adding exe_file_allow_write_access() before filp_close() in
put_binfmt_handler().  exe_file_allow_write_access() is NULL-safe
and skips FMODE_FSNOTIFY_HSM files, so no imbalance is possible.

Fixes: 948b701a607f ("binfmt_misc: add persistent opened binary handler for containers")
Cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Aayush7352 <aayushdixit924@gmail.com>
---
 fs/binfmt_misc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index 84349fcb9..de50a7468 100644
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -162,8 +162,10 @@ static Node *get_binfmt_handler(struct binfmt_misc *misc,
 static void put_binfmt_handler(Node *e)
 {
 	if (refcount_dec_and_test(&e->users)) {
-		if (e->flags & MISC_FMT_OPEN_FILE)
+		if (e->flags & MISC_FMT_OPEN_FILE) {
+			exe_file_allow_write_access(e->interp_file);
 			filp_close(e->interp_file, NULL);
+		}
 		kfree(e);
 	}
 }
-- 
2.55.0