Re: [PATCH] kernel/kmod: fix use-after-free of the sub_info structure

[Oleg Nesterov]

On 10/16, Oleg Nesterov wrote:
>
> OK... I am wondering if __call_usermodehelper() still needs CLONE_VFORK
> with this patch.

Yes, looks like it doesn't, but this needs another patch.

> > @@ -588,7 +580,7 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait)
> >  		goto out;
> >  	}
> >
> > -	sub_info->complete = &done;
> > +	sub_info->complete = (wait == UMH_NO_WAIT) ? NULL : &done;
>
> This probably needs a comment, and the comment in umh_complete() should
> be updated,
>
> 	- we own sub_info, the UMH_KILLABLE caller has gone away.
> 	+ we own sub_info, the UMH_KILLABLE caller has gone away
> 	+ or the caller used UMH_NO_WAIT.
>
> The patch looks correct at first glance. I'll try to re-read it later
> once again.

Reviewed-by: Oleg Nesterov <oleg@xxxxxxxxxx>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/