v2
2026-07-10
binfmt_misc写访问修复 · v2
Christian Brauner 提交 v2 补丁系列，修复 binfmt_misc 写入访问并添加 RCU 处理程序查找。
本次提交拆成 23 个子 patch：binfmt_misc: restore write access when removing an entry、binfmt_misc: use exe_file_deny_write_access() for the interpreter clone、binfmt_misc: convert entry list to an hlist、binfmt_misc: use RCU for the handler lookup、binfmt_misc: annotate racy accesses to ->enabled 等共 23 项改动。
原始补丁链接
子 Patch（23）
1/23原始邮件 ↗
binfmt_misc: restore write access when removing an entry
Registering an entry with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec() which denies write access to
2/23原始邮件 ↗
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
For MISC_FMT_OPEN_FILE entries load_misc_binary() clones the registered interpreter file and denies write access to the
3/23原始邮件 ↗
binfmt_misc: convert entry list to an hlist
The upcoming conversion of the handler lookup to RCU walks cannot use list_del_init(): reinitializing the forward pointe
4/23原始邮件 ↗
binfmt_misc: use RCU for the handler lookup
Once binfmt_misc is loaded load_misc_binary() runs for every execve() on the system since binfmt_misc registers at the h
5/23原始邮件 ↗
binfmt_misc: annotate racy accesses to ->enabled
->enabled has always been read and written locklessly: every exec reads it in load_misc_binary() while bm_status_write()
6/23原始邮件 ↗
binfmt_misc: turn the entry bit numbers into a proper enum
Enabled and Magic are bit numbers in the flags word of an entry but are declared as bare, unprefixed enumerators with im
7/23原始邮件 ↗
binfmt_misc: turn the entry behavior flags into an enum
The MISC_FMT_* behavior flags are macros using unsigned long literals while the entry bit numbers right above them are n
8/23原始邮件 ↗
binfmt_misc: rename Node to struct binfmt_misc_entry
The CamelCase Node typedef is a 1997 leftover and hides that this is a plain struct. Call it what it is: struct binfmt_m
9/23原始邮件 ↗
binfmt_misc: remove the VERBOSE_STATUS toggle
VERBOSE_STATUS is a compile-time constant that has been fixed to 1 for as long as git history reaches. Turning it off re
10/23原始邮件 ↗
binfmt_misc: use print_hex_dump_debug() for the register debug output
The hex dumps in create_entry() are compiled out unless someone edits the file to define DEBUG while the pr_debug() call
11/23原始邮件 ↗
binfmt_misc: convert the entry file to seq_file
Reading an entry file allocates a whole page and formats the status into it with a chain of manually advanced sprintf()
12/23原始邮件 ↗
binfmt_misc: factor out the entry matching
search_binfmt_handler() open-codes both match types in one loop body with the maskless magic comparison spelled as a man
13/23原始邮件 ↗
binfmt_misc: rename load_binfmt_misc() to current_binfmt_misc()
load_binfmt_misc() is one word swap away from load_misc_binary(), the binfmt loader it serves. It doesn't load anything,
14/23原始邮件 ↗
binfmt_misc: return errors directly in load_misc_binary()
load_misc_binary() seeds retval with the error for checks that happen further down, reassigns it along the way and funne
15/23原始邮件 ↗
binfmt_misc: give the parse_command() results names
parse_command() maps "0" to 1, "1" to 2 and "-1" to 3 and the write handlers switch on those bare numbers, leaving every
16/23原始邮件 ↗
binfmt_misc: factor out the entry removal
Both write handlers open-code the same removal dance - grab the root inode lock, unlink, unlock - each carrying a verbat
17/23原始邮件 ↗
binfmt_misc: simplify check_special_flags()
Replace the cont flag and the pointer increment repeated in every case with a for loop that returns from the default cas
18/23原始邮件 ↗
binfmt_misc: use a flexible array member for the register string
create_entry() allocates the entry and the register string it parses into in one chunk and finds the string part again t
19/23原始邮件 ↗
binfmt_misc: split the field parsing out of create_entry()
create_entry() is a two hundred line parser with the M and E field handling inlined as the two arms of its largest branc
20/23原始邮件 ↗
binfmt_misc: use __free(kfree) in bm_register_write()
bm_register_write() has to free the entry it got from create_entry() on every failure until add_entry() has linked it in
21/23原始邮件 ↗
binfmt_misc: assorted small cleanups
Use umode_t for the mode argument of bm_get_inode(), constify the fixed status strings in bm_status_read(), give the sup
22/23原始邮件 ↗
binfmt_misc: include what is used
The include list still reflects code that left this file years ago: nothing here uses sched/mm.h, pagemap.h, namei.h, sy
23/23原始邮件 ↗
binfmt_misc: allow removing entries via unlink(2)
Removing a binary type handler requires echoing -1 into its entry file which works but is an odd interface to discover f