Re: [patch] Race condition in usermodehelper.

[Adrian Bunk <bunk@stusta.de>]

Thanks, applied to 2.6.16 (with a note that Kenneth Lee also sent the 
same patch independently).

cu
Adrian

On Fri, Sep 15, 2006 at 12:46:54PM +0200, Martin Schwidefsky wrote:
> From: Martin Schwidefsky <schwidefsky@de.ibm.com>
> 
> [patch] Race condition in usermodehelper.
> 
> There is a race between call_usermodehelper_keys, __call_usermodehelper
> and wait_for_helper. It should only happen if preemption is enabled or
> on a virtualized system.
> 
> If the cpu is preempted or put to sleep by the hypervisor in
> __call_usermodehelper between the creation of the wait_for_helper
> thread and the second check on sub_info->wait, the whole execution
> of wait_for_helper including the complete call and the continuation
> after the wait_for_completion in call_usermodehelper_keys can have
> happened before __call_usermodehelper checks sub_info->wait for the
> second time. Since sub_info can already have been clobbered,
> sub_info->wait could be zero and complete is called a second time
> with an invalid argument. This has happened on s390. It took me only
> three days to find out ..
> 
> Thanks to Arnd Bergmann for his help to spot this bug.
> 
> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
> ---
> 
>  kernel/kmod.c |    5 +++--
>  1 files changed, 3 insertions(+), 2 deletions(-)
> 
> diff -urpN linux-2.6/kernel/kmod.c linux-2.6-patched/kernel/kmod.c
> --- linux-2.6/kernel/kmod.c	2006-09-15 12:17:52.000000000 +0200
> +++ linux-2.6-patched/kernel/kmod.c	2006-09-15 12:18:00.000000000 +0200
> @@ -196,12 +196,13 @@ static int wait_for_helper(void *data)
>  static void __call_usermodehelper(void *data)
>  {
>  	struct subprocess_info *sub_info = data;
> +	int wait = sub_info->wait;
>  	pid_t pid;
>  
>  	/* CLONE_VFORK: wait until the usermode helper has execve'd
>  	 * successfully We need the data structures to stay around
>  	 * until that is done.  */
> -	if (sub_info->wait)
> +	if (wait)
>  		pid = kernel_thread(wait_for_helper, sub_info,
>  				    CLONE_FS | CLONE_FILES | SIGCHLD);
>  	else
> @@ -211,7 +212,7 @@ static void __call_usermodehelper(void *
>  	if (pid < 0) {
>  		sub_info->retval = pid;
>  		complete(sub_info->complete);
> -	} else if (!sub_info->wait)
> +	} else if (!wait)
>  		complete(sub_info->complete);
>  }
>