linux-kernel - [RFC PATCH] kobject: fix uevent helper execution order issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_22B2504A61A3281D6A2590CB43ABCCEC790A@qq.com>
Date: Wed, 20 Aug 2025 01:18:28 +0800
From: zhoumin <teczm@...mail.com>
To: gregkh@...uxfoundation.org,
	rafael@...nel.org,
	dakr@...nel.org,
	akpm@...ux-foundation.org
Cc: linux-kernel@...r.kernel.org,
	zhoumin <teczm@...mail.com>
Subject: [RFC PATCH] kobject: fix uevent helper execution order issues

The current use of the UMH_NO_WAIT parameter does not guarantee the
sequential execution of CONFIG_STATIC_USERMODEHELPER_PATH.

For example, when fdisk completes and issues a BLKRRPART ioctl command,
kernel first sending remove events followed by an add events. However, 
process CONFIG_STATIC_USERMODEHELPER_PATH may execute
out-of-order—potentially handling the add before the remove. This can
result in the new partition being unexpectedly unmounted instead of mounted
as intended.

Admittedly, the current approach does not fully ensure that all
CONFIG_STATIC_USERMODEHELPER_PATH helpers execute in strict sequential
order. I have not yet identified a more robust solution and welcome
feedback on this issue. That said, if a mechanism can be established to
enforce reliable ordering of these user-mode helpers, higher-level
synchronization primitives—such as file locks—could then be used to
coordinate the overall execution sequence in userspace.

Test Log:

CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"

~ # cat /sbin/hotplug
#!/bin/sh
echo hotplug $DEVPATH $ACTION $DEVTYPE $MAJOR $MINOR $SUBSYSTEM > /dev/console
~ #

~ # fdisk /dev/sda

The number of cylinders for this disk is set to 8354.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:
1) software that runs at boot time (e.g., old versions of LILO)
2) booting and partitioning software from other OSs
   (e.g., DOS FDISK, OS/2 FDISK)

Command (m for help): p
Disk /dev/sda: 64 GB, 68719476736 bytes, 134217728 sectors
8354 cylinders, 255 heads, 63 sectors/track
Units: sectors of 1 * 512 = 512 bytes

Device  Boot StartCHS    EndCHS        StartLBA     EndLBA    Sectors  Size Id Type
/dev/sda1    0,1,1       12,191,50           63     204862     204800  100M 83 Linux
/dev/sda2    12,191,51   25,127,37       204863     409662     204800  100M 83 Linux
/dev/sda3    25,127,38   127,123,59      409663    2048062    1638400  800M 83 Linux
/dev/sda4    127,123,60  178,122,7      2048063    2867262     819200  400M  5 Extended
/dev/sda5    127,124,60  178,122,7      2048126    2867262     819137  399M 83 Linux

Command (m for help): wq
The partition table has been altered.
Calling ioctl() to re-read partition table
[  282.069158]  sda: sda1 sda2 sda3 sda4 < sda5 >
hotplug /devices/platform/4010000000.pcie/pci0000:00/0000:00:01.0/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda2 remove partition 8 2 block
~ # hotplug /devices/platform/4010000000.pcie/pci0000:00/0000:00:01.0/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda1 remove partition 8 1 block
hotplug /devices/platform/4010000000.pcie/pci0000:00/0000:00:01.0/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda3 remove partition 8 3 block
hotplug /devices/platform/4010000000.pcie/pci0000:00/0000:00:01.0/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda5 add partition 8 5 block
hotplug /devices/platform/4010000000.pcie/pci0000:00/0000:00:01.0/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda5 remove partition 8 5 block
hotplug /devices/platform/4010000000.pcie/pci0000:00/0000:00:01.0/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda3 add partition 8 3 block
hotplug /devices/platform/4010000000.pcie/pci0000:00/0000:00:01.0/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda4 remove partition 8 4 block
hotplug /devices/platform/4010000000.pcie/pci0000:00/0000:00:01.0/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda2 add partition 8 2 block
hotplug /devices/platform/4010000000.pcie/pci0000:00/0000:00:01.0/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda1 add partition 8 1 block
hotplug /devices/platform/4010000000.pcie/pci0000:00/0000:00:01.0/ata1/host0/target0:0:0/0:0:0:0/block/sda change disk 8 0 block
hotplug /devices/platform/4010000000.pcie/pci0000:00/0000:00:01.0/ata1/host0/target0:0:0/0:0:0:0/block/sda/sda4 add partition 8 4 block




Signed-off-by: zhoumin <teczm@...mail.com>
---
 lib/kobject_uevent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index b7f2fa08d9c8..fd7b9d4c46c0 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -629,7 +629,7 @@ int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
 						 env->envp, GFP_KERNEL,
 						 NULL, cleanup_uevent_env, env);
 		if (info) {
-			retval = call_usermodehelper_exec(info, UMH_NO_WAIT);
+			retval = call_usermodehelper_exec(info, UMH_WAIT_EXEC);
 			env = NULL;	/* freed by cleanup_uevent_env */
 		}
 	}
-- 
2.43.0