[PATCH RFC v2 08/16] exec: release fdtable after exec locks drop

[Christian Brauner <brauner@kernel.org>]

During exec the task gets a private fdtable and releases the shared
fdtable. This all happens under cred_guard_mutex. If the exec'ing task
has the last reference on the fdtable close_files() closes all files.
Today this happens to be deferred to task work. Following patches will
make that part synchronous so the final put needs to move out of the
cred_guard_mutex.

The shared table now lives until free_bprm() instead of dying in
begin_new_exec(). This doesn't matter as nothing can get access to the
old table anymore and closing of files would've been deferred to task
work anyway.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
 fs/exec.c               | 6 ++++--
 include/linux/binfmts.h | 2 ++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/exec.c b/fs/exec.c
index 713819244d23..be8601d9c691 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1165,7 +1165,7 @@ int begin_new_exec(struct linux_binprm * bprm)
 	if (retval)
 		goto out;
 	if (files)
-		put_files_struct(switch_files_struct(me, files));
+		bprm->old_files = switch_files_struct(me, files);
 
 	/*
 	 * Must be called _before_ exec_mmap() as bprm->mm is
@@ -1472,7 +1472,9 @@ static void free_bprm(struct linux_binprm *bprm)
 		mutex_unlock(&current->signal->cred_guard_mutex);
 		abort_creds(bprm->cred);
 	}
-	/* The exec locks are out of the way now, see close_cloexec_files(). */
+	/* The exec locks are gone, release what begin_new_exec() closed. */
+	if (bprm->old_files)
+		put_files_struct(bprm->old_files);
 	fput_list(&bprm->cloexec_files);
 	/* exec swapped the mm but failed before setup_new_exec() freed it */
 	if (bprm->old_mm)
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index be935320f1c7..0f0fcf859b4f 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -37,6 +37,8 @@ struct linux_binprm {
 #endif
 	struct mm_struct *mm;
 	struct mm_struct *old_mm;	/* replaced address space, freed by setup_new_exec() */
+	/* Descriptor table displaced by begin_new_exec(), put by free_bprm(). */
+	struct files_struct *old_files;
 	/* user_ns published to task->exec_state at execve, narrowed by would_dump(). */
 	struct user_namespace *user_ns;
 	unsigned long p; /* current top of mem */

-- 
2.53.0