Hi,

We have found a *bug* which is pretty serious. It is related to adding
new binary formats using CONFIG_BINFMT_MISC when the support for
CONFIG_BINFMT_MISC is compiled as a module.

A person can register a new binary format which may override the existing
binary formats and hence lead to system lockups or reboots.
We have tested it on various 2.2.6 Linux boxes and the problem is reproducible.

This is a simple test :

1) Compile support for CONFIG_BINFMT_MISC as a module.

2)
[root@sagrawal] /usr/src/linux_new# lsmod
Module                  Size  Used by
binfmt_misc             3108   0

3) 
[root@sagrawal] echo ":perl:M::E:\x00:/usr/bin/perl:" > /proc/sys/fs/binfmt_misc/register

4)
Try running any ELF binary and the system reboots.

We have tracked down this problem. The problem is that register_binfmt()
in /usr/src/linux/fs/exec.c adds the new binary format to the beginning of the 
linked list. The 'echo' statement above , overrides the default ELF binary
handling as the magic/mask pair matches the magic number(ELF) for any ELF binary.
It is very impractical to expect that a person knows about all existing binary
formats before adding a new binary format , hence we have patched exec.c
to append the new binary formats at the end of the link list. 


* We have tested this patch and it is running on all our machines without any
problems when CONFIG_BINFMT_MISC is compiled into the kernel or as a module.

Also we would like to point out that there are some flaws in
binfmt_misc.c

/usr/src/linux/fs/binfmt_misc.c
>> snip Line Number 310
if ((*sp & ~('E' | 'M')) || (sp[1] != del))
                err = -EINVAL;

>>

Even a string echoed with type I or A can work as M and E respectively.
There should be a cleaner way of doing things :-)



Kindly find attached the patch along with this mail and let us know
of any problems you face. It is working very well for us without nasty
reboots ;-))

Cheers,
Sharad Agrawal
Suman Saraf
Hughes Software Systems , India
--- exec.c	Sun Apr 25 02:33:41 1999
+++ exec.c.ours	Sun Apr 25 02:32:28 1999
@@ -53,9 +53,6 @@
 
 void __init binfmt_setup(void)
 {
-#ifdef CONFIG_BINFMT_MISC
-	init_misc_binfmt();
-#endif
 
 #ifdef CONFIG_BINFMT_ELF
 	init_elf_binfmt();
@@ -81,8 +78,13 @@
 	init_em86_binfmt();
 #endif
 
+#ifdef CONFIG_BINFMT_MISC
+	init_misc_binfmt();
+#endif
+
 	/* This cannot be configured out of the kernel */
 	init_script_binfmt();
+
 }
 
 int register_binfmt(struct linux_binfmt * fmt)
@@ -98,8 +100,8 @@
 			return -EBUSY;
 		tmp = &(*tmp)->next;
 	}
-	fmt->next = formats;
-	formats = fmt;
+
+	(*tmp)=fmt;
 	return 0;	
 }
 --- CREDITS.orig	Sun Apr 25 02:36:06 1999
+++ CREDITS	Sun Apr 25 02:38:40 1999
@@ -2240,6 +2240,22 @@
 S: 95560 Montsoult
 S: France
 
+N: Sharad Agrawal
+E: sagrawal@hss.hns.com
+D: Exec patch
+S: Hughes Software Systems
+S: Plot 31, Sector 18 , Electronic City
+S: Gurgaon, Haryana
+S: India
+ 
+N: Suman Saraf
+E: ssaraf@hss.hns.com
+D: Exec patch
+S: Hughes Software Systems
+S: Plot 31, Sector 18 , Electronic City
+S: Gurgaon, Haryana
+S: India
+
 # Don't add your name here, unless you really _are_ after Marc
 # alphabetically. Leonard used to be very proud of being the 
 # last entry, and he'll get positively pissed if he can't even