From nobody Sat Jul 25 01:24:23 2026 Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 440C83AD53F for ; Tue, 21 Jul 2026 08:47:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784623669; cv=none; b=muWFKpNbRm1vITVasav7cpW4IOzHo06YtoMup2A3IGaa1gsbhrbYPkl1OYhjOrJJ8tdwpewNSuGaE1CFN9FkAbi4ZTgFl4Bot1i1ohskpq9IOH79GKSfNtud+iKhOwFG5yIWXksicK8QmS5gGJ0e7NNsGww/KYH6+F4j9UhLzL4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784623669; c=relaxed/simple; bh=F7E/fevZGREnKNOFDpeucj81dgcEzXnGUrVa6tJQVSM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=CyUSL2Du6xTqzVuG2UCPe0uSK/Uev+BbSe6ejQ04e/6p8YGgXLMI4tPk8jOv3lWRzkme2YaxTa27MbmqmJAQR512AWPiyLMZTFCZ1dp3CoGj8RgcJvgb/o8slidOT9IpiY9A/QEbv94MshqmOc6Lz+mmav0e9Na+HWlL3vF1PYM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bcQ/N4mp; arc=none smtp.client-ip=209.85.210.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bcQ/N4mp" Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-8486ac3f347so3885704b3a.1 for ; Tue, 21 Jul 2026 01:47:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784623668; x=1785228468; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Pst/rsRfBSd3UPzARuf28kFUe4BuzsljjgHEUWwqZn4=; b=bcQ/N4mpdpJg8CV4Jf5RxgQrGJQ9+XVkPKhtheJ6p3v7Wor6fKbcKB1nj5imUDrSCe LkIi1h5eSZGEIbH6NgI4hT7gkTyKysHkVz6ysVRYAiHlRwbehfr0uvnqEycn0+AqvByj JPEKlDiNmIgmW1zDQQtvIRd5O77OpU2c3iSbzjSY7HYkFS8881ZNTcfZ64IltQ/tSR4j /cxhqMhdZX91mvMUsd1mkxb9NqY9MgO6Lh+1T6g7+mWlW0xNzmddm5yJSE7ZJnXCGfD7 ADVos1uahc2HwDqO3HCl9JhhUVCXFQMxMQEp5bPdyWeqxXlJifsxPBKv3UPvISdX6sJc uDRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784623668; x=1785228468; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Pst/rsRfBSd3UPzARuf28kFUe4BuzsljjgHEUWwqZn4=; b=r/GDPs4LDjRhrFK1He2o84flQ9a+ompCuKbuJebqDQcdq3l/DU19dD6aRPN3WPJOmo O9KxQxhp2Fnkm89FotJANIfOsTVERc/ZlLkVqptqSGR62fFnUu8ODmL98mS/SM9lmsF4 Rw5PG3SgNs7zaUBN//LViFqcx3ufcSMwAsS4Qw1MYQafkigmOmTD1SfJc0BntNX/7pPc hY/ndZKrkEeXPghHX0XCB9quWJ34tjzLeWCYp9iy2VtEvRXS2Z1gt3JbykqT9BFCnssn 9Nj/2PEbwbTLHm557qjPOtddTHDihiJofIF59VA4iBAkzBtU19t7HlFiFUGR21faa/Ox C+vQ== X-Forwarded-Encrypted: i=1; AHgh+Rqei8boS/yS2qv7G8P5gY0H2Zr25p2MFMJAzxhb+AxPaY3pcjyjiVtqrR3MNr5KpnjO93SwJpyTU8gUt/o=@vger.kernel.org X-Gm-Message-State: AOJu0YyBgrC6BTQlb0Evf2GGYqULrh7VH0Fj0dolS6YRg/5Ao0Kt/Pz+ ieDxFlARje2HND7NIn+l+2xb2otcebGQIW/OIaFoqvATDupB662HnpJr X-Gm-Gg: AfdE7ckBXObxl0Sp6PEdfsiRP+2oZa/+/rfsHXmugzZnA/NRuSvvoQXP8SGR7N8jOxg /ZmxTs0dPFv3GtgjANmUmCw/jnkgWfMubAT3ZQ7zNj01cuMkcMKNKn//2urySaC/LZgDkFTC2Lc gSeE4qSdgm2tu8kR8d5oXOPRWolMqfSLDEzQrgf9tZTneyUw7RD0Z/M/1pAMeqp6hpdlWtWQ2HL c/mge8SQTDX4iEAsoX5tDdqw2HzVkxkfaF+aNXgDXRlPub2621NqoOWf5X+wPvU7pFHMuFAfDMr ybtqskcAf+rK1+vuBBBJ9sDVGFRaFvQupvuoh0enuZg/smdI3Ulv15NAWVfrvcORSKL0g4jPozv MUIXEAytpN4JvkYiozzAq8b61F3GOSY9FsmnkDbR0AdLLBcq7ZWy/mw+iUwEPK9kwvxzHwx9UEl I0KHBGPxTj5tNPbdmNgvAQT/f7AJVlpCIPh+NwyXJNciTgjgU= X-Received: by 2002:a05:6300:6690:b0:3b3:a66e:3911 with SMTP id adf61e73a8af0-3c38db31692mr22774653637.19.1784623667613; Tue, 21 Jul 2026 01:47:47 -0700 (PDT) Received: from localhost.localdomain ([125.20.165.194]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3142a20b1f3sm43735487eec.26.2026.07.21.01.47.44 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 21 Jul 2026 01:47:47 -0700 (PDT) From: Aayush7352 To: linux-fsdevel@vger.kernel.org Cc: Alexander Viro , Christian Brauner , Kees Cook , linux-kernel@vger.kernel.org, Aayush7352 Subject: [PATCH] binfmt_misc: fix leaked write-access denial on F-flag interpreter inode Date: Tue, 21 Jul 2026 14:17:41 +0530 Message-ID: <20260721084741.79326-1-aayushdixit924@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" put_binfmt_handler() closes an F-flag (MISC_FMT_OPEN_FILE) entry's interpreter file without restoring the write access that open_exec() denied at registration. Every register/delete cycle of an F entry leaks one i_writecount denial on the interpreter's inode, so that inode returns -ETXTBSY to all writers until it is evicted from the inode cache or the machine reboots. The registration error path (add_entry failure) correctly calls exe_file_allow_write_access() before filp_close(), but the normal teardown path in put_binfmt_handler() was missing it. Fix by adding exe_file_allow_write_access() before filp_close() in put_binfmt_handler(). exe_file_allow_write_access() is NULL-safe and skips FMODE_FSNOTIFY_HSM files, so no imbalance is possible. Fixes: 948b701a607f ("binfmt_misc: add persistent opened binary handler for= containers") Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Aayush7352 --- fs/binfmt_misc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c index 84349fcb9..de50a7468 100644 --- a/fs/binfmt_misc.c +++ b/fs/binfmt_misc.c @@ -162,8 +162,10 @@ static Node *get_binfmt_handler(struct binfmt_misc *mi= sc, static void put_binfmt_handler(Node *e) { if (refcount_dec_and_test(&e->users)) { - if (e->flags & MISC_FMT_OPEN_FILE) + if (e->flags & MISC_FMT_OPEN_FILE) { + exe_file_allow_write_access(e->interp_file); filp_close(e->interp_file, NULL); + } kfree(e); } } --=20 2.55.0