linux-stable.git/kernel/signal.c, branch v3.16.41

kernel/signal.c: unexport sigsuspend()

2015-12-14T10:17:11+00:00

commit 9d8a765211335cfdad464b90fb19f546af5706ae upstream.

sigsuspend() is nowhere used except in signal.c itself, so we can mark it
static do not pollute the global namespace.

But this patch is more than a boring cleanup patch, it fixes a real issue
on UserModeLinux.  UML has a special console driver to display ttys using
xterm, or other terminal emulators, on the host side.  Vegard reported
that sometimes UML is unable to spawn a xterm and he's facing the
following warning:

  WARNING: CPU: 0 PID: 908 at include/linux/thread_info.h:128 sigsuspend+0xab/0xc0()

It turned out that this warning makes absolutely no sense as the UML
xterm code calls sigsuspend() on the host side, at least it tries.  But
as the kernel itself offers a sigsuspend() symbol the linker choose this
one instead of the glibc wrapper.  Interestingly this code used to work
since ever but always blocked signals on the wrong side.  Some recent
kernel change made the WARN_ON() trigger and uncovered the bug.

It is a wonderful example of how much works by chance on computers. :-)

Fixes: 68f3f16d9ad0f1 ("new helper: sigsuspend()")
Signed-off-by: Richard Weinberger 
Reported-by: Vegard Nossum 
Tested-by: Vegard Nossum 
Acked-by: Oleg Nesterov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Luis Henriques

signal: fix information leak in copy_siginfo_from_user32

2015-09-03T15:48:46+00:00

commit 3c00cb5e68dc719f2fc73a33b1b230aadfcb1309 upstream.

This function can leak kernel stack data when the user siginfo_t has a
positive si_code value.  The top 16 bits of si_code descibe which fields
in the siginfo_t union are active, but they are treated inconsistently
between copy_siginfo_from_user32, copy_siginfo_to_user32 and
copy_siginfo_to_user.

copy_siginfo_from_user32 is called from rt_sigqueueinfo and
rt_tgsigqueueinfo in which the user has full control overthe top 16 bits
of si_code.

This fixes the following information leaks:
x86:   8 bytes leaked when sending a signal from a 32-bit process to
       itself. This leak grows to 16 bytes if the process uses x32.
       (si_code = __SI_CHLD)
x86:   100 bytes leaked when sending a signal from a 32-bit process to
       a 64-bit process. (si_code = -1)
sparc: 4 bytes leaked when sending a signal from a 32-bit process to a
       64-bit process. (si_code = any)

parsic and s390 have similar bugs, but they are not vulnerable because
rt_[tg]sigqueueinfo have checks that prevent sending a positive si_code
to a different process.  These bugs are also fixed for consistency.

Signed-off-by: Amanieu d'Antras 
Cc: Oleg Nesterov 
Cc: Ingo Molnar 
Cc: Russell King 
Cc: Ralf Baechle 
Cc: Benjamin Herrenschmidt 
Cc: Chris Metcalf 
Cc: Paul Mackerras 
Cc: Michael Ellerman 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Luis Henriques

signal: fix information leak in copy_siginfo_to_user

2015-09-03T15:47:12+00:00

commit 26135022f85105ad725cda103fa069e29e83bd16 upstream.

This function may copy the si_addr_lsb, si_lower and si_upper fields to
user mode when they haven't been initialized, which can leak kernel
stack data to user mode.

Just checking the value of si_code is insufficient because the same
si_code value is shared between multiple signals.  This is solved by
checking the value of si_signo in addition to si_code.

Signed-off-by: Amanieu d'Antras 
Cc: Oleg Nesterov 
Cc: Ingo Molnar 
Cc: Russell King 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
[ luis: backported to 3.16:
  - dropped 2nd hunk in kernel/signal.c ]
Signed-off-by: Luis Henriques

signals: introduce kernel_sigaction()

2014-06-06T23:08:12+00:00

Now that allow_signal() is really trivial we can unify it with
disallow_signal().  Add the new helper, kernel_sigaction(), and
reimplement allow_signal/disallow_signal as a trivial wrappers.

This saves one EXPORT_SYMBOL() and the new helper can have more users.

Signed-off-by: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Al Viro 
Cc: David Woodhouse 
Cc: Frederic Weisbecker 
Cc: Geert Uytterhoeven 
Cc: Ingo Molnar 
Cc: Mathieu Desnoyers 
Cc: Richard Weinberger 
Cc: Steven Rostedt 
Cc: Tejun Heo 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

signals: disallow_signal() should flush the potentially pending signal

2014-06-06T23:08:12+00:00

disallow_signal() simply sets SIG_IGN, this is not enough and
recalc_sigpending() is simply pointless because in can never change the
state of TIF_SIGPENDING.

If we ignore a signal, we also need to do flush_sigqueue_mask() for the
case when this signal is pending, this way recalc_sigpending() can
actually clear TIF_SIGPENDING and we do not "leak" the allocated
siginfo's.

Signed-off-by: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Al Viro 
Cc: David Woodhouse 
Cc: Frederic Weisbecker 
Cc: Geert Uytterhoeven 
Cc: Ingo Molnar 
Cc: Mathieu Desnoyers 
Cc: Richard Weinberger 
Cc: Steven Rostedt 
Cc: Tejun Heo 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

signals: kill the obsolete sigdelset() and recalc_sigpending() in allow_signal()

2014-06-06T23:08:11+00:00

allow_signal() does sigdelset(current->blocked) due to historic reason,
previously it could be called by a daemonize()'ed kthread, and
daemonize() played with current->blocked.

Now that daemonize() has gone away we can remove sigdelset() and
recalc_sigpending().  If a user really wants to unblock a signal, it
must use sigprocmask() or set_current_block() explicitely.

Signed-off-by: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Al Viro 
Cc: David Woodhouse 
Cc: Frederic Weisbecker 
Cc: Geert Uytterhoeven 
Cc: Ingo Molnar 
Cc: Mathieu Desnoyers 
Cc: Richard Weinberger 
Cc: Steven Rostedt 
Cc: Tejun Heo 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

signals: mv {dis,}allow_signal() from sched.h/exit.c to signal.[ch]

2014-06-06T23:08:11+00:00

Move the declaration/definition of allow_signal/disallow_signal to
signal.h/signal.c.  The new place is more logical and allows to use the
static helpers in signal.c (see the next changes).

While at it, make them return void and remove the valid_signal() check.
Nobody checks the returned value, and in-kernel users must not pass the
wrong signal number.

Signed-off-by: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Al Viro 
Cc: David Woodhouse 
Cc: Frederic Weisbecker 
Cc: Geert Uytterhoeven 
Cc: Ingo Molnar 
Cc: Mathieu Desnoyers 
Cc: Richard Weinberger 
Cc: Steven Rostedt 
Cc: Tejun Heo 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

signals: cleanup the usage of t/current in do_sigaction()

2014-06-06T23:08:11+00:00

The usage of "task_struct *t" and "current" in do_sigaction() looks really
annoying and chaotic.  Initially "t" is used as a cached value of current
but not consistently, then it is reused as a loop variable and we have to
use "current" again.

Clean up this mess and also convert the code to use for_each_thread().

Signed-off-by: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Al Viro 
Cc: David Woodhouse 
Cc: Frederic Weisbecker 
Cc: Geert Uytterhoeven 
Cc: Ingo Molnar 
Cc: Mathieu Desnoyers 
Cc: Richard Weinberger 
Cc: Steven Rostedt 
Cc: Tejun Heo 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

signals: rename rm_from_queue_full() to flush_sigqueue_mask()

2014-06-06T23:08:11+00:00

"rm_from_queue_full" looks ugly and misleading, especially now that
rm_from_queue() has gone away.  Rename it to flush_sigqueue_mask(), this
matches flush_sigqueue() we already have.

Also remove the obsolete comment which explains the difference with
rm_from_queue() we already killed.

Signed-off-by: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Al Viro 
Cc: David Woodhouse 
Cc: Frederic Weisbecker 
Cc: Geert Uytterhoeven 
Cc: Ingo Molnar 
Cc: Mathieu Desnoyers 
Cc: Richard Weinberger 
Cc: Steven Rostedt 
Cc: Tejun Heo 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

signals: kill rm_from_queue(), change prepare_signal() to use for_each_thread()

2014-06-06T23:08:11+00:00

rm_from_queue() doesn't make sense.  The only caller, prepare_signal(),
can use rm_from_queue_full() with the same effect.

While at it, change prepare_signal() to use for_each_thread() instead of
do/while_each_thread.

Signed-off-by: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Al Viro 
Cc: David Woodhouse 
Cc: Frederic Weisbecker 
Cc: Geert Uytterhoeven 
Cc: Ingo Molnar 
Cc: Mathieu Desnoyers 
Cc: Richard Weinberger 
Cc: Steven Rostedt 
Cc: Tejun Heo 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds