From: Aayush Dixit <aayushdixit924@gmail.com>

put_binfmt_handler() closes an F-flag (MISC_FMT_OPEN_FILE) entry's
interpreter file without restoring the write access that open_exec()
denied at registration.  Every register/delete cycle of an F entry
leaks one i_writecount denial on the interpreter's inode, so that
inode returns -ETXTBSY to all writers until it is evicted from the
inode cache or the machine reboots.

The registration error path (add_entry failure) correctly calls
exe_file_allow_write_access() before filp_close(), but the normal
teardown path in put_binfmt_handler() was missing it.

Fix by adding exe_file_allow_write_access() before filp_close() in
put_binfmt_handler().  exe_file_allow_write_access() is NULL-safe
and skips FMODE_FSNOTIFY_HSM files, so no imbalance is possible.

Fixes: 948b701a607f ("binfmt_misc: add persistent opened binary handler for containers")
Cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Aayush7352 <aayushdixit924@gmail.com>
---
 fs/binfmt_misc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index 84349fcb9..de50a7468 100644
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -162,8 +162,10 @@ static Node *get_binfmt_handler(struct binfmt_misc *misc,
 static void put_binfmt_handler(Node *e)
 {
 	if (refcount_dec_and_test(&e->users)) {
-		if (e->flags & MISC_FMT_OPEN_FILE)
+		if (e->flags & MISC_FMT_OPEN_FILE) {
+			exe_file_allow_write_access(e->interp_file);
 			filp_close(e->interp_file, NULL);
+		}
 		kfree(e);
 	}
 }
-- 
2.55.0

On 2026-07-21 15:26 +0530, Aayush7352 wrote:
> From: Aayush Dixit <aayushdixit924@gmail.com>
> 
> put_binfmt_handler() closes an F-flag (MISC_FMT_OPEN_FILE) entry's
> interpreter file without restoring the write access that open_exec()
> denied at registration.  Every register/delete cycle of an F entry
> leaks one i_writecount denial on the interpreter's inode, so that
> inode returns -ETXTBSY to all writers until it is evicted from the
> inode cache or the machine reboots.
> 
> The registration error path (add_entry failure) correctly calls
> exe_file_allow_write_access() before filp_close(), but the normal
> teardown path in put_binfmt_handler() was missing it.
> 
> Fix by adding exe_file_allow_write_access() before filp_close() in
> put_binfmt_handler().  exe_file_allow_write_access() is NULL-safe
> and skips FMODE_FSNOTIFY_HSM files, so no imbalance is possible.
> 
> Fixes: 948b701a607f ("binfmt_misc: add persistent opened binary handler for containers")
> Cc: linux-fsdevel@vger.kernel.org
> Signed-off-by: Aayush7352 <aayushdixit924@gmail.com>
> ---

Sorry, there's already a fix in vfs-7.3.binfmt for this.