Commit eedeb787 authored by Peter Zijlstra's avatar Peter Zijlstra
Browse files

freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL 



Tetsuo-San noted that commit f5d39b02 ("freezer,sched: Rewrite
core freezer logic") broke call_usermodehelper_exec() for the KILLABLE
case.

Specifically it was missed that the second, unconditional,
wait_for_completion() was not optional and ensures the on-stack
completion is unused before going out-of-scope.

Fixes: f5d39b02 ("freezer,sched: Rewrite core freezer logic")
Reported-by: default avatar <syzbot+6cd18e123583550cf469@syzkaller.appspotmail.com>
Reported-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Debugged-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/Y90ar35uKQoUrLEK@hirez.programming.kicks-ass.net
parent ceaa837f

kernel/umh.c

+13 −7
Original line number Diff line number Diff line
@@ -438,21 +438,27 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait) 
	if (wait == UMH_NO_WAIT)	/* task has freed sub_info */

		goto unlock;



	if (wait & UMH_KILLABLE)

		state |= TASK_KILLABLE;



	if (wait & UMH_FREEZABLE)

		state |= TASK_FREEZABLE;



	retval = wait_for_completion_state(&done, state);

	if (wait & UMH_KILLABLE) {

		retval = wait_for_completion_state(&done, state | TASK_KILLABLE);

		if (!retval)

			goto wait_done;



	if (wait & UMH_KILLABLE) {

		/* umh_complete() will see NULL and free sub_info */

		if (xchg(&sub_info->complete, NULL))

			goto unlock;



		/*

		 * fallthrough; in case of -ERESTARTSYS now do uninterruptible

		 * wait_for_completion_state(). Since umh_complete() shall call

		 * complete() in a moment if xchg() above returned NULL, this

		 * uninterruptible wait_for_completion_state() will not block

		 * SIGKILL'ed processes for long.

		 */

	}

	wait_for_completion_state(&done, state);



wait_done:

	retval = sub_info->retval;