linux-kernel - Re: [PATCH] (2.4.25 material?) Fix unbalanced helper

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 17 Jan 2008 11:23:32 -0800
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	"Rafael J. Wysocki" <rjw@...k.pl>
Cc:	nigel@...el.suspend2.net, LKML <linux-kernel@...r.kernel.org>,
	pm list <linux-pm@...ts.linux-foundation.org>,
	TuxOnIce-devel <tuxonice-devel@...ts.tuxonice.net>,
	Pavel Machek <pavel@....cz>
Subject: Re: [PATCH] (2.4.25 material?) Fix unbalanced helper_lock in
 kernel/kmod.c

On Thu, 17 Jan 2008 19:02:43 +0100 "Rafael J. Wysocki" <rjw@...k.pl> wrote:

> On Thursday, 17 of January 2008, Nigel Cunningham wrote:
> > Hi all.
> 
> Hi,
> 
> > First up, sorry for not inlining the patch - trouble with line wrapping.
> 
> No big deal.
> 
> > In 2.6.24-rc8, call_usermodehelper_exec has an exit path that can leave
> > the helper_lock() call at the top of the routine unbalanced. The
> > attached patch fixes this issue.
> 
> Thanks a lot for the patch (reproduced below), I think it's 2.6.24 material.
> Andrew?
> 
> > Signed-off-by: Nigel Cunningham <nigel@...onice.net>
> 
> ---
> From: Nigel Cunningham <nigel@...onice.net>
> 
> In 2.6.24-rc8, call_usermodehelper_exec has an exit path that can leave
> the helper_lock() call at the top of the routine unbalanced.  Fix it.
> 
> Signed-off-by: Nigel Cunningham <nigel@...onice.net>
> Signed-off-by: Rafael J. Wysocki <rjw@...k.pl>
> ---
> diff --git a/kernel/kmod.c b/kernel/kmod.c
> index c6a4f8a..de27e15 100644
> --- a/kernel/kmod.c
> +++ b/kernel/kmod.c
> @@ -468,8 +468,10 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info,
>  	sub_info->wait = wait;
>  
>  	queue_work(khelper_wq, &sub_info->work);
> -	if (wait == UMH_NO_WAIT) /* task has freed sub_info */
> +	if (wait == UMH_NO_WAIT) { /* task has freed sub_info */
> +		helper_unlock();
>  		return 0;
> +	}
>  	wait_for_completion(&done);
>  	retval = sub_info->retval;
>  

Yup, I ended up queueing this:

From: Nigel Cunningham <nigel@...el.suspend2.net>

call_usermodehelper_exec() has an exit path that can leave the
helper_lock() call at the top of the routine unbalanced.  The attached
patch fixes this issue.

Signed-off-by: Nigel Cunningham <nigel@...onice.net>
Cc: <stable@...nel.org>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---

 kernel/kmod.c |   13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff -puN kernel/kmod.c~fix-unbalanced-helper_lock-in-kernel-kmodc kernel/kmod.c
--- a/kernel/kmod.c~fix-unbalanced-helper_lock-in-kernel-kmodc
+++ a/kernel/kmod.c
@@ -451,13 +451,11 @@ int call_usermodehelper_exec(struct subp
 			     enum umh_wait wait)
 {
 	DECLARE_COMPLETION_ONSTACK(done);
-	int retval;
+	int retval = 0;
 
 	helper_lock();
-	if (sub_info->path[0] == '\0') {
-		retval = 0;
+	if (sub_info->path[0] == '\0')
 		goto out;
-	}
 
 	if (!khelper_wq || usermodehelper_disabled) {
 		retval = -EBUSY;
@@ -468,13 +466,14 @@ int call_usermodehelper_exec(struct subp
 	sub_info->wait = wait;
 
 	queue_work(khelper_wq, &sub_info->work);
-	if (wait == UMH_NO_WAIT) /* task has freed sub_info */
-		return 0;
+	if (wait == UMH_NO_WAIT)	/* task has freed sub_info */
+		goto unlock;
 	wait_for_completion(&done);
 	retval = sub_info->retval;
 
-  out:
+out:
 	call_usermodehelper_freeinfo(sub_info);
+unlock:
 	helper_unlock();
 	return retval;
 }
_

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/