]> git.kernelconcepts.de Git - karo-tx-linux.git/commit
kernel/kmod.c: fix a race condition in usermodehelper.
authorMartin Schwidefsky <schwidefsky@de.ibm.com>
Fri, 22 Sep 2006 00:32:57 +0000 (02:32 +0200)
committerAdrian Bunk <bunk@stusta.de>
Fri, 22 Sep 2006 00:32:57 +0000 (02:32 +0200)
commit579adde438b457e2110e6f6ec11fb7ffefa43b8c
tree785ff6737b43b7ed52aa0bd321316b6e087fe8d4
parentab469df3639caa59abac80bdfe2d863cc74eb3eb
kernel/kmod.c: fix a race condition in usermodehelper.

There is a race between call_usermodehelper_keys, __call_usermodehelper
and wait_for_helper. It should only happen if preemption is enabled or
on a virtualized system.

If the cpu is preempted or put to sleep by the hypervisor in
__call_usermodehelper between the creation of the wait_for_helper
thread and the second check on sub_info->wait, the whole execution
of wait_for_helper including the complete call and the continuation
after the wait_for_completion in call_usermodehelper_keys can have
happened before __call_usermodehelper checks sub_info->wait for the
second time. Since sub_info can already have been clobbered,
sub_info->wait could be zero and complete is called a second time
with an invalid argument. This has happened on s390. It took me only
three days to find out ..

Thanks to Arnd Bergmann for his help to spot this bug.

Kenneth Lee also sent the same patch independently.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
kernel/kmod.c