binfmt_misc: fix possible deadlock in bm_register_write

[linux-2.6-block.git] / fs / binfmt_misc.c

diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index c457334de43f8709cc5ee162d2382ebb3fb4f199..e1eae7ea823aeb2d5d0b245511658fcdb3a3ed09 100644 (file)
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -649,12 +649,24 @@ static ssize_t bm_register_write(struct file *file, const char __user *buffer,
        struct super_block *sb = file_inode(file)->i_sb;
        struct dentry *root = sb->s_root, *dentry;
        int err = 0;
+       struct file *f = NULL;
 
        e = create_entry(buffer, count);
 
        if (IS_ERR(e))
                return PTR_ERR(e);
 
+       if (e->flags & MISC_FMT_OPEN_FILE) {
+               f = open_exec(e->interpreter);
+               if (IS_ERR(f)) {
+                       pr_notice("register: failed to install interpreter file %s\n",
+                                e->interpreter);
+                       kfree(e);
+                       return PTR_ERR(f);
+               }
+               e->interp_file = f;
+       }
+
        inode_lock(d_inode(root));
        dentry = lookup_one_len(e->name, root, strlen(e->name));
        err = PTR_ERR(dentry);
@@ -678,21 +690,6 @@ static ssize_t bm_register_write(struct file *file, const char __user *buffer,
                goto out2;
        }
 
-       if (e->flags & MISC_FMT_OPEN_FILE) {
-               struct file *f;
-
-               f = open_exec(e->interpreter);
-               if (IS_ERR(f)) {
-                       err = PTR_ERR(f);
-                       pr_notice("register: failed to install interpreter file %s\n", e->interpreter);
-                       simple_release_fs(&bm_mnt, &entry_count);
-                       iput(inode);
-                       inode = NULL;
-                       goto out2;
-               }
-               e->interp_file = f;
-       }
-
        e->dentry = dget(dentry);
        inode->i_private = e;
        inode->i_fop = &bm_entry_operations;
@@ -709,6 +706,8 @@ out:
        inode_unlock(d_inode(root));
 
        if (err) {
+               if (f)
+                       filp_close(f, NULL);
                kfree(e);
                return err;
        }