linux-kernel - Re: [3.1.6] Deadlock upon recursive call_usermodehelper

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201112270814.pBR8E5SS026269@www262.sakura.ne.jp>
Date:	Tue, 27 Dec 2011 17:14:05 +0900
From:	Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:	gregkh@...e.de, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [3.1.6] Deadlock upon recursive call_usermodehelper_exec().

Additional info. I added debug printk()

--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -305,8 +305,13 @@ int kobject_uevent_env(struct kobject *k
 		if (retval)
 			goto exit;
 
+		printk(KERN_INFO "*** Calling call_usermodehelper(\"%s\")\n",
+		       argv[0]);
 		retval = call_usermodehelper(argv[0], argv,
 					     env->envp, UMH_WAIT_EXEC);
+		printk(KERN_INFO
+		       "*** Returned from call_usermodehelper(\"%s\")\n",
+		       argv[0]);
 	}
 
 exit:
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1435,7 +1435,14 @@ int search_binary_handler(struct linux_b
 				break; /* -ENOEXEC */
 			if (try)
 				break; /* -ENOEXEC */
+			printk(KERN_INFO
+			       "*** Calling request_module(\"binfmt-%04x\")\n",
+			       *(unsigned short *)(&bprm->buf[2]));
 			request_module("binfmt-%04x", *(unsigned short *)(&bprm->buf[2]));
+			printk(KERN_INFO
+			       "*** Returned from "
+			       "request_module(\"binfmt-%04x\")\n",
+			       *(unsigned short *)(&bprm->buf[2]));
 		}
 #else
 		break;

and got below output just before deadlock.

*** Calling call_usermodehelper("/sbin/hotplug")
*** Calling request_module("binfmt-0000")

So, this deadlock occurs when call_usermodehelper(UMH_WAIT_EXEC) is called and
request_module() is also called from search_binary_handler() when processing
call_usermodehelper(UMH_WAIT_EXEC).

This would not hanppen for normal condition, but 100% happens when the
userspace helper program is damaged.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/