Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933505Ab3CGVgI (ORCPT ); Thu, 7 Mar 2013 16:36:08 -0500 Received: from mail-qa0-f42.google.com ([209.85.216.42]:52900 "EHLO mail-qa0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933432Ab3CGVgG (ORCPT ); Thu, 7 Mar 2013 16:36:06 -0500 MIME-Version: 1.0 In-Reply-To: <20130307200722.GA22072@redhat.com> References: <1361802350-9299-1-git-send-email-lucas.demarchi@profusion.mobi> <20130225160642.GA31806@redhat.com> <20130225180802.GA6160@redhat.com> <20130307193701.GA20385@redhat.com> <20130307200722.GA22072@redhat.com> From: Lucas De Marchi Date: Thu, 7 Mar 2013 18:35:44 -0300 Message-ID: Subject: Re: [PATCH] usermodehelper: Fix -ENOMEM return logic To: Oleg Nesterov Cc: linux-kernel@vger.kernel.org, David Howells , James Morris , Andrew Morton Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1722 Lines: 43 On Thu, Mar 7, 2013 at 5:07 PM, Oleg Nesterov wrote: > On 03/07, Lucas De Marchi wrote: >> >> On Thu, Mar 7, 2013 at 4:37 PM, Oleg Nesterov wrote: >> > >> >> @@ -98,12 +93,13 @@ static int call_modprobe(char *module_name, int wait) >> >> argv[3] = module_name; /* check free_modprobe_argv() */ >> >> argv[4] = NULL; >> >> >> >> - return call_usermodehelper_fns(modprobe_path, argv, envp, >> >> - wait | UMH_KILLABLE, NULL, free_modprobe_argv, NULL); >> >> + ret = call_usermodehelper(modprobe_path, argv, envp, >> >> + wait | UMH_KILLABLE); >> >> + kfree(module_name); >> > >> > Please note UMH_KILLABLE. call_usermodehelper() can be interrupted >> > and even UMH_WAIT_EXEC case is not safe. If call_modprobe() is killed >> > we can return while the workqueue thread still tries to clone/exec/etc. >> >> Even if it's killed, we would just free the resource we allocated >> before. > > Yes, and after that ____call_usermodehelper() can do > do_execve(module_name) ? > >> It would not be safe if we allocated in the init function and >> freed in the cleanup. > > But we do? We free this memory in cleanup ? And I was allocated by us. > > sub_info itself can't go away (if you meant this), but > sub_info->path/argv/envp can. Oh... you are right - the UMH_KILLABLE is the problem here. Dunno what I was thinking :-/. I will fix my pending the patches. thanks Lucas De Marchi -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/