wait_for_helper: SIGCHLD from user-space can lead to use-after-free
in [Kernel]
|
Prev: call_usermodehelper: call info->init() after set_user_nice()
Next: [PATCH trivial] MAINTAINERS: Use tab not spaces for delimiter
From: Roland McGrath on 10 Mar 2010 15:40 SIGCHLD being blocked doesn't affect reaping, so SIG_IGN or sa_flags & SA_NOCLDWAIT is the only thing that would do this. How does that come about here in this kthread? Is it inherited from the instigating user process? If so, then SA_NOCLDWAIT is as much a problem as SIG_IGN. Or I guess maybe it's from ignore_signals() in kthreadd()? In that case SIG_IGN is indeed all that matters. (I don't really know all the kthread/kmod/userhelper code organization.) Perhaps it would be cleaner to do: flush_signal_handlers(current, 1); in wait_for_helper. That should make it redundant in ____call_usermodehelper, so it could be removed from there. Thanks, Roland -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: Roland McGrath on 10 Mar 2010 16:30 > Yes. kthreads run with all signal ignored, this is inherited from > kthreadd() which does ignore_signal(). Ok. > I don't think this can work. SIG_DFL for SIGCHLD is OK because it is > sig_kernel_ignore(). But, say, SIGHUP and other signals still should > be ignored, otherwise we have the same problems with the unwanted > signal_pending() this patch tries to avoid. Yes, I see. > But even if we could do this, > > > That should make it redundant in ____call_usermodehelper, > > so it could be removed from there. > > Please note that __call_usermodehelper() forks ____call_usermodehelper() too. Ok. Thanks, Roland -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: Oleg Nesterov on 10 Mar 2010 16:30
On 03/10, Roland McGrath wrote: > > SIGCHLD being blocked doesn't affect reaping, so SIG_IGN or sa_flags & > SA_NOCLDWAIT is the only thing that would do this. How does that come > about here in this kthread? Is it inherited from the instigating user > process? If so, then SA_NOCLDWAIT is as much a problem as SIG_IGN. > Or I guess maybe it's from ignore_signals() in kthreadd()? > In that case SIG_IGN is indeed all that matters. (I don't really > know all the kthread/kmod/userhelper code organization.) Yes. kthreads run with all signal ignored, this is inherited from kthreadd() which does ignore_signal(). > Perhaps it would be cleaner to do: > > flush_signal_handlers(current, 1); > > in wait_for_helper I don't think this can work. SIG_DFL for SIGCHLD is OK because it is sig_kernel_ignore(). But, say, SIGHUP and other signals still should be ignored, otherwise we have the same problems with the unwanted signal_pending() this patch tries to avoid. But even if we could do this, > That should make it redundant in ____call_usermodehelper, > so it could be removed from there. Please note that __call_usermodehelper() forks ____call_usermodehelper() too. Oleg. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ |