[PATCH] after exec_mmap(), exec cannot fail

If de_thread() fails in flush_old_exec() then we try to fail the execve().

That is a bad move, because exec_mmap() has already switched the current
process over to the new mm.  The new process is not yet sufficiently set up
to handle the error and the kernel doublefaults and dies.  exec_mmap() is the
point of no return.

Change flush_old_exec() to call de_thread() before running exec_mmap() so the
execing program sees the error.  I added fault injection to both de_thread()
and exec_mmap() - everything now survives OK.

fs/exec.c

@@ -760,16 +760,17 @@ int flush_old_exec(struct linux_binprm * bprm)
 	int i, ch, retval;
 
 	/*
-	 * Release all of the old mmap stuff
+	 * Make sure we have a private signal table and that
+	 * we are unassociated from the previous thread group.
 	 */
-	retval = exec_mmap(bprm->mm);
+	retval = de_thread(current);
 	if (retval)
 		goto out;
+
 	/*
-	 * Make sure we have a private signal table and that
-	 * we are unassociated from the previous thread group.
+	 * Release all of the old mmap stuff
 	 */
-	retval = de_thread(current);
+	retval = exec_mmap(bprm->mm);
 	if (retval)
 		goto out;