From nobody Sat Jul 25 00:52:27 2026 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDDEF44D00A for ; Tue, 21 Jul 2026 09:57:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784627828; cv=none; b=IAlxosYS4NRKgLCoEk+yEjj/szrIXwYqcRHlcONG6LzfDv4FnIpLrJvNysmLtuZ3bwNJLFXnjbhuDYqkbcSP78lEHgOnbPbgrfrOhq4J5m4ULxdTKoIyUYdMNmaYy7zcQbOD3uRw4T4my/N5PJ92+JYP0n5US0alvpA45KwDv/U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784627828; c=relaxed/simple; bh=bgWznk9oVRBJ9R3oMQeubuZtjVDAtCNEiaxdjPJ0AEw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=l0lcPvJwOX9HvrhbyLgf6Qz486Ra/0yhrIGs/hkDvcn3WEU5YUL+6pkCMDWw4/OrGtd5FLlvol4ZpZzkhivCfc4vxCh4b6yl3Pp+VfFJwDb7kQ9wVx9Gs/kS1a1yVsLfDvNdGxGorfx+xgC2vgSuFBTxsNTBrBuuvSGOsJ0ZS8c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=haZzZtTy; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="haZzZtTy" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2cace91f112so113970445ad.0 for ; Tue, 21 Jul 2026 02:57:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784627826; x=1785232626; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=8cXrE8/1rGTla5GSK6N2YSNzDuAdTPtHrBFCyOKm5TY=; b=haZzZtTy4wdUkNB2KclskqizPk1HJAx4omrkSq0i/2FRSDYsgB7CBma4BYQLL+twwB 04n2BytmlTBIR/j1ish+YLh1efTHAC4rUbxxVHp5dsLgt3fhOMHw6br3EpqEja3g4B+r yM1PyNq4rcgt6+Jo1mSOCMr4evAS3XfVsu5ExEFSbuM3Ftq0DtZhfRQkPFs3i/sbVvL4 UYHpaEqWOAUy8M59e+IoJ5E1CR66bgA9YPgXD7lo3CcOK8uCl2Jtw7HbJKZGwZM8kpaC MJ6ymKgaO/yVP3QpyijRwkjdpe000QwyePtrKdxxG8CKhAs8y7is/TkQKMPz0suKMt7+ mmvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784627826; x=1785232626; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8cXrE8/1rGTla5GSK6N2YSNzDuAdTPtHrBFCyOKm5TY=; b=JcpIjy+DhGTbc6NJFkmapBHQ/crcl6RLx2DNFrfQcD/KkybpK7uJVps/wdA3G9Tndb Qc90bbtsowtKbzBELvVOIbGWHqA3MbEBxj/3x9sbjTkKDJX5st2qSuJ1B7rFZCZKXs8m 9LOo+P6Ys33NRgrxoI/zazBv46Dr9tjiAFrVePKSZHxeZaclo6n+uLsnu8+8EM1TJ0Da CNC7uSws/PLQCYnu0lH/Bk80cYEmnk43917Cr7SnSQXE7Yv0J2K+5k+xFH5D+9YZUDtC 7E54hgPnOtoQOo6yOORIJwlzpVJpUW/isEQWQr2888SOueMsSxzdHrcnz/p5TLjy+Jyq 2kFA== X-Forwarded-Encrypted: i=1; AHgh+RrjQsq7qYbk9oFvzUbqLhX46H76BM44OvZOu2uIqEGfC7DFQmIqg5dPGhW2NUYq6LhEmIy+v0fcmqE/m7I=@vger.kernel.org X-Gm-Message-State: AOJu0YzV+PGpFkU3NBGFwqz0JOxO8mKb94q4Ru9LdCW40UN4nu+df2+l TmTYpLYmj41DAlKAH1ZPg7VzUzy8JrqUeM6hl7i+CO99Me0ujTwQwfOP X-Gm-Gg: AfdE7cnzvkaVfwstSXWCshBinIn8bLjX8XMrVOrIzgbgf3mLjQQwUvs5Zm1U6uFYh0t YZVNM/Ww2JLBVcy9H41vlucbNL5J6J4JdDLxZxNFuRzsacmhfE0lO4lgfYU2BwrbQwAEzKixMwk WAjlrWE05LELD0Dw2Zt2IDQhCtAiLFgF8exICBAEp1KlAKjuxCoZfZhY1QY28tm4lYroqdCNKVd S9WSAwPRwCUtWFXA+MhX7AF3OvdsDw+A2aFdbHMVUwEOlzGHt6GvoYUeilAxQ4OD3z1bzfid28Z FkjZNO89nxZfNSFnydP8wKLSyQTCvrFqVKRHSwF1irbqm82uUjWfwTLkkUfodoaJwMdqIY84Svj /cXEBeC7ZBOUMha0WMSnBxJrWGlWQPZzEXbPdyFc4K1CsTxdqFWdtU1FtwGmuDesIEmGCpAqoHN Lnf6OzB+QoK1/pvICaDm56AWhPR7YKOmQKv1rV X-Received: by 2002:a05:6a21:7111:b0:3c0:9c19:659b with SMTP id adf61e73a8af0-3c3ada4aaa2mr18870459637.67.1784627826283; Tue, 21 Jul 2026 02:57:06 -0700 (PDT) Received: from localhost.localdomain ([125.20.165.194]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31429fdcaefsm44535314eec.10.2026.07.21.02.57.02 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 21 Jul 2026 02:57:05 -0700 (PDT) From: Aayush7352 To: linux-fsdevel@vger.kernel.org Cc: Alexander Viro , Christian Brauner , Kees Cook , linux-kernel@vger.kernel.org, Aayush Dixit Subject: [PATCH] binfmt_misc: fix leaked write-access denial on F-flag interpreter inode Date: Tue, 21 Jul 2026 15:26:59 +0530 Message-ID: <20260721095659.80690-1-aayushdixit924@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Aayush Dixit put_binfmt_handler() closes an F-flag (MISC_FMT_OPEN_FILE) entry's interpreter file without restoring the write access that open_exec() denied at registration. Every register/delete cycle of an F entry leaks one i_writecount denial on the interpreter's inode, so that inode returns -ETXTBSY to all writers until it is evicted from the inode cache or the machine reboots. The registration error path (add_entry failure) correctly calls exe_file_allow_write_access() before filp_close(), but the normal teardown path in put_binfmt_handler() was missing it. Fix by adding exe_file_allow_write_access() before filp_close() in put_binfmt_handler(). exe_file_allow_write_access() is NULL-safe and skips FMODE_FSNOTIFY_HSM files, so no imbalance is possible. Fixes: 948b701a607f ("binfmt_misc: add persistent opened binary handler for= containers") Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Aayush7352 --- fs/binfmt_misc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c index 84349fcb9..de50a7468 100644 --- a/fs/binfmt_misc.c +++ b/fs/binfmt_misc.c @@ -162,8 +162,10 @@ static Node *get_binfmt_handler(struct binfmt_misc *mi= sc, static void put_binfmt_handler(Node *e) { if (refcount_dec_and_test(&e->users)) { - if (e->flags & MISC_FMT_OPEN_FILE) + if (e->flags & MISC_FMT_OPEN_FILE) { + exe_file_allow_write_access(e->interp_file); filp_close(e->interp_file, NULL); + } kfree(e); } } --=20 2.55.0