linux-kernel - Re: [PATCH] shm: fix a race between shm_exit() and shm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20110803123352.88670c9c.akpm@linux-foundation.org>
Date:	Wed, 3 Aug 2011 12:33:52 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Vasiliy Kulikov <segoon@...nwall.com>,
	Manuel Lauss <manuel.lauss@...glemail.com>,
	linux-kernel@...r.kernel.org, Richard Weinberger <richard@....at>,
	Marc Zyngier <maz@...terjones.org>,
	Ingo Molnar <mingo@...e.hu>,
	kernel-hardening@...ts.openwall.com,
	"Paul E. McKenney" <paul.mckenney@...aro.org>,
	Kay Sievers <kay.sievers@...y.org>
Subject: Re: [PATCH] shm: fix a race between shm_exit() and shm_init()

On Tue, 2 Aug 2011 21:43:23 -1000
Linus Torvalds <torvalds@...ux-foundation.org> wrote:

> On Tue, Aug 2, 2011 at 2:45 AM, Vasiliy Kulikov <segoon@...nwall.com> wrote:
> >
> > From: Vasiliy Kulikov <segoon@...nwall.com>
> > Subject: [PATCH] shm: fix a race between shm_exit() and shm_init()
> 
> This patch is disgusting.
> 

I think it's buggy too.

> 
> > +       /*
> > +        * For init_ipc_ns shm_ids().rw_mutex is statically initialized
> > +        * as kernel threads should be able to use it in do_exit() before
> > +        * shm_init(), which is called on do_initcall()
> > +        */
> > +       if (ns == &init_ipc_ns)
> > +                ipc_init_ids(&shm_ids(ns));
> > +       else
> > +               ipc_init_ids(&shm_ids(ns));

afacit init_ipc_ns.ids[0].rw_mutex and init_ipc_ns.ids[1].rw_mutex
never get initialised with this patch?


Still.  It seems that the real bug is that driver_init() is trying to
invoke userspace helpers before the kernel is ready to run userspace.

We could hack around it with something like

--- a/init/main.c~a
+++ a/init/main.c
@@ -108,6 +108,9 @@ bool early_boot_irqs_disabled __read_mos
 enum system_states system_state __read_mostly;
 EXPORT_SYMBOL(system_state);
 
+/* This gets set when the kernel is ready to execute usermode code */
+bool usermode_available = false;
+
 /*
  * Boot command-line arguments
  */
@@ -804,6 +807,8 @@ static int __init kernel_init(void * unu
 
 	do_basic_setup();
 
+	usermode_available = true;
+
 	/* Open the /dev/console on the rootfs, this should never fail */
 	if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
 		printk(KERN_WARNING "Warning: unable to open an initial console.\n");
diff -puN include/linux/init.h~a include/linux/init.h
--- a/include/linux/init.h~a
+++ a/include/linux/init.h
@@ -149,6 +149,7 @@ extern int do_one_initcall(initcall_t fn
 extern char __initdata boot_command_line[];
 extern char *saved_command_line;
 extern unsigned int reset_devices;
+extern bool usermode_available;
 
 /* used by init/main.c */
 void setup_arch(char **);
diff -puN kernel/kmod.c~a kernel/kmod.c
--- a/kernel/kmod.c~a
+++ a/kernel/kmod.c
@@ -418,6 +418,9 @@ int call_usermodehelper_exec(struct subp
 	DECLARE_COMPLETION_ONSTACK(done);
 	int retval = 0;
 
+	if (usermode_available == false)
+		return -EINVAL;
+
 	helper_lock();
 	if (sub_info->path[0] == '\0')
 		goto out;
_


(which I think deserves a big fat WARN_ON() when it triggers)

But it would be better to fix driver_init() for real.

Save us, Kay!
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/