aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNeil Horman <nhorman@tuxdriver.com>2009-09-22 16:43:36 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2009-09-23 07:39:28 -0700
commitc02e3f361c75da04ca3025b4d19e947e9cc62ed3 (patch)
tree92605809366dda20430fa9dc7d0b9b9f2f3c0bd9
parent1fd7317d02ec03c6fdf072317841287933d06d24 (diff)
kmod: fix race in usermodehelper code
The user mode helper code has a race in it. call_usermodehelper_exec() takes an allocated subprocess_info structure, which it passes to a workqueue, and then passes it to a kernel thread which it creates, after which it calls complete to signal to the caller of call_usermodehelper_exec() that it can free the subprocess_info struct. But since we use that structure in the created thread, we can't call complete from __call_usermodehelper(), which is where we create the kernel thread. We need to call complete() from within the kernel thread and then not use subprocess_info afterward in the case of UMH_WAIT_EXEC. Tested successfully by me. Signed-off-by: Neil Horman <nhorman@tuxdriver.com> Cc: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--kernel/kmod.c13
1 files changed, 8 insertions, 5 deletions
diff --git a/kernel/kmod.c b/kernel/kmod.c
index 9fcb53a11f8..689d20f3930 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -143,6 +143,7 @@ struct subprocess_info {
static int ____call_usermodehelper(void *data)
{
struct subprocess_info *sub_info = data;
+ enum umh_wait wait = sub_info->wait;
int retval;
BUG_ON(atomic_read(&sub_info->cred->usage) != 1);
@@ -184,10 +185,14 @@ static int ____call_usermodehelper(void *data)
*/
set_user_nice(current, 0);
+ if (wait == UMH_WAIT_EXEC)
+ complete(sub_info->complete);
+
retval = kernel_execve(sub_info->path, sub_info->argv, sub_info->envp);
/* Exec failed? */
- sub_info->retval = retval;
+ if (wait != UMH_WAIT_EXEC)
+ sub_info->retval = retval;
do_exit(0);
}
@@ -266,16 +271,14 @@ static void __call_usermodehelper(struct work_struct *work)
switch (wait) {
case UMH_NO_WAIT:
+ case UMH_WAIT_EXEC:
break;
case UMH_WAIT_PROC:
if (pid > 0)
break;
sub_info->retval = pid;
- /* FALLTHROUGH */
-
- case UMH_WAIT_EXEC:
- complete(sub_info->complete);
+ break;
}
}