lkml.org 
[lkml]   [2009]   [Jun]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] kmod: Fix race in usermodehelper code
    User Mode Helper: Fix race in UMH_WAIT_EXEC case

    The user mode helper code has a race in it. call_usermodehelper_exec takes an
    allocated subprocess_info structure, which it passes to a workqueue, and then
    passes it to a kernel thread which it creates, after which it calls complete to
    signal to the caller of call_usremodehelper_exec that it can free the
    subprocess_info struct. But since we use that structure in the created thread,
    we can't call complete from __call_usermodehelper, which is where we create the
    kernel_thread. We need to call complete from within the kernel thread and then
    not use subprocess_info afterward in the case of UMH_WAIT_EXEC. Tested
    successfully by me.

    Signed-off-by: Neil Horman <nhorman@tuxdriver.com>

    diff --git a/kernel/kmod.c b/kernel/kmod.c
    index 7e95bed..afff87a 100644
    --- a/kernel/kmod.c
    +++ b/kernel/kmod.c
    @@ -136,6 +136,7 @@ struct subprocess_info {
    static int ____call_usermodehelper(void *data)
    {
    struct subprocess_info *sub_info = data;
    + enum umh_wait wait = sub_info->wait;
    int retval;

    BUG_ON(atomic_read(&sub_info->cred->usage) != 1);
    @@ -177,10 +178,14 @@ static int ____call_usermodehelper(void *data)
    */
    set_user_nice(current, 0);

    + if (wait == UMH_WAIT_EXEC)
    + complete(sub_info->complete);
    +
    retval = kernel_execve(sub_info->path, sub_info->argv, sub_info->envp);

    /* Exec failed? */
    - sub_info->retval = retval;
    + if (wait != UMH_WAIT_EXEC)
    + sub_info->retval = retval;
    do_exit(0);
    }

    @@ -259,16 +264,14 @@ static void __call_usermodehelper(struct work_struct *work)

    switch (wait) {
    case UMH_NO_WAIT:
    + case UMH_WAIT_EXEC:
    break;

    case UMH_WAIT_PROC:
    if (pid > 0)
    break;
    sub_info->retval = pid;
    - /* FALLTHROUGH */
    -
    - case UMH_WAIT_EXEC:
    - complete(sub_info->complete);
    + break;
    }
    }


    \
     
     \ /
      Last update: 2009-07-01 04:51    [W:0.023 / U:1.916 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site