lkml.org 
[lkml]   [2009]   [Jun]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] kmod: Fix race in usermodehelper code
User Mode Helper: Fix race in UMH_WAIT_EXEC case

The user mode helper code has a race in it. call_usermodehelper_exec takes an
allocated subprocess_info structure, which it passes to a workqueue, and then
passes it to a kernel thread which it creates, after which it calls complete to
signal to the caller of call_usremodehelper_exec that it can free the
subprocess_info struct. But since we use that structure in the created thread,
we can't call complete from __call_usermodehelper, which is where we create the
kernel_thread. We need to call complete from within the kernel thread and then
not use subprocess_info afterward in the case of UMH_WAIT_EXEC. Tested
successfully by me.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>

diff --git a/kernel/kmod.c b/kernel/kmod.c
index 7e95bed..afff87a 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -136,6 +136,7 @@ struct subprocess_info {
static int ____call_usermodehelper(void *data)
{
struct subprocess_info *sub_info = data;
+ enum umh_wait wait = sub_info->wait;
int retval;

BUG_ON(atomic_read(&sub_info->cred->usage) != 1);
@@ -177,10 +178,14 @@ static int ____call_usermodehelper(void *data)
*/
set_user_nice(current, 0);

+ if (wait == UMH_WAIT_EXEC)
+ complete(sub_info->complete);
+
retval = kernel_execve(sub_info->path, sub_info->argv, sub_info->envp);

/* Exec failed? */
- sub_info->retval = retval;
+ if (wait != UMH_WAIT_EXEC)
+ sub_info->retval = retval;
do_exit(0);
}

@@ -259,16 +264,14 @@ static void __call_usermodehelper(struct work_struct *work)

switch (wait) {
case UMH_NO_WAIT:
+ case UMH_WAIT_EXEC:
break;

case UMH_WAIT_PROC:
if (pid > 0)
break;
sub_info->retval = pid;
- /* FALLTHROUGH */
-
- case UMH_WAIT_EXEC:
- complete(sub_info->complete);
+ break;
}
}


\
 
 \ /
  Last update: 2009-07-01 04:51    [W:0.047 / U:0.164 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site