send_sigio_to_task: sanitize the usage of fown->signum
send_sigio_to_task() reads fown->signum several times, we can race with F_SETSIG which changes ->signum lockless. In theory, this can fool security checks or we can call group_send_sig_info() with the wrong ->si_signo which does not match "int sig". Change the code to cache ->signum. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
f83b1e616f
commit
8eeee4e2f0
16
fs/fcntl.c
16
fs/fcntl.c
|
@ -428,14 +428,20 @@ static inline int sigio_perm(struct task_struct *p,
|
||||||
}
|
}
|
||||||
|
|
||||||
static void send_sigio_to_task(struct task_struct *p,
|
static void send_sigio_to_task(struct task_struct *p,
|
||||||
struct fown_struct *fown,
|
struct fown_struct *fown,
|
||||||
int fd,
|
int fd,
|
||||||
int reason)
|
int reason)
|
||||||
{
|
{
|
||||||
if (!sigio_perm(p, fown, fown->signum))
|
/*
|
||||||
|
* F_SETSIG can change ->signum lockless in parallel, make
|
||||||
|
* sure we read it once and use the same value throughout.
|
||||||
|
*/
|
||||||
|
int signum = ACCESS_ONCE(fown->signum);
|
||||||
|
|
||||||
|
if (!sigio_perm(p, fown, signum))
|
||||||
return;
|
return;
|
||||||
|
|
||||||
switch (fown->signum) {
|
switch (signum) {
|
||||||
siginfo_t si;
|
siginfo_t si;
|
||||||
default:
|
default:
|
||||||
/* Queue a rt signal with the appropriate fd as its
|
/* Queue a rt signal with the appropriate fd as its
|
||||||
|
@ -444,7 +450,7 @@ static void send_sigio_to_task(struct task_struct *p,
|
||||||
delivered even if we can't queue. Failure to
|
delivered even if we can't queue. Failure to
|
||||||
queue in this case _should_ be reported; we fall
|
queue in this case _should_ be reported; we fall
|
||||||
back to SIGIO in that case. --sct */
|
back to SIGIO in that case. --sct */
|
||||||
si.si_signo = fown->signum;
|
si.si_signo = signum;
|
||||||
si.si_errno = 0;
|
si.si_errno = 0;
|
||||||
si.si_code = reason;
|
si.si_code = reason;
|
||||||
/* Make sure we are called with one of the POLL_*
|
/* Make sure we are called with one of the POLL_*
|
||||||
|
@ -456,7 +462,7 @@ static void send_sigio_to_task(struct task_struct *p,
|
||||||
else
|
else
|
||||||
si.si_band = band_table[reason - POLL_IN];
|
si.si_band = band_table[reason - POLL_IN];
|
||||||
si.si_fd = fd;
|
si.si_fd = fd;
|
||||||
if (!group_send_sig_info(fown->signum, &si, p))
|
if (!group_send_sig_info(signum, &si, p))
|
||||||
break;
|
break;
|
||||||
/* fall-through: fall back on the old plain SIGIO signal */
|
/* fall-through: fall back on the old plain SIGIO signal */
|
||||||
case 0:
|
case 0:
|
||||||
|
|
Loading…
Reference in a new issue