diff options
| author | Oleg Nesterov <oleg@redhat.com> | 2013-05-16 17:43:55 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-05-19 11:38:45 -0700 |
| commit | 98b17e9decaf1b103e4d0dd9ded21188c63dd475 (patch) | |
| tree | 3f59ab2f81e46e0c0241b1114923333ef7a5ab57 /kernel | |
| parent | e48c45d58f425fe3ff5a0e8a7584121682643096 (diff) | |
| download | lwn-98b17e9decaf1b103e4d0dd9ded21188c63dd475.tar.gz lwn-98b17e9decaf1b103e4d0dd9ded21188c63dd475.zip | |
usermodehelper: check subprocess_info->path != NULL
commit 264b83c07a84223f0efd0d1db9ccc66d6f88288f upstream.
argv_split(empty_or_all_spaces) happily succeeds, it simply returns
argc == 0 and argv[0] == NULL. Change call_usermodehelper_exec() to
check sub_info->path != NULL to avoid the crash.
This is the minimal fix, todo:
- perhaps we should change argv_split() to return NULL or change the
callers.
- kill or justify ->path[0] check
- narrow the scope of helper_lock()
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-By: Lucas De Marchi <lucas.demarchi@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/kmod.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/kernel/kmod.c b/kernel/kmod.c index 56dd34976d7b..8985c874a2af 100644 --- a/kernel/kmod.c +++ b/kernel/kmod.c @@ -570,6 +570,11 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait) int retval = 0; helper_lock(); + if (!sub_info->path) { + retval = -EINVAL; + goto out; + } + if (sub_info->path[0] == '\0') goto out; |