mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
compat: Fix RT signal mask corruption via sigprocmask
compat_sys_sigprocmask reads a smaller signal mask from userspace than sigprogmask accepts for setting. So the high word of blocked.sig[0] will be cleared, releasing any potentially blocked RT signal. This was discovered via userspace code that relies on get/setcontext. glibc's i386 versions of those functions use sigprogmask instead of rt_sigprogmask to save/restore signal mask and caused RT signal unblocking this way. As suggested by Linus, this replaces the sys_sigprocmask based compat version with one that open-codes the required logic, including the merge of the existing blocked set with the new one provided on SIG_SETMASK. Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
7ee94d97aa
commit
b7dafa0ef3
|
@ -372,25 +372,54 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
|
|||
|
||||
#ifdef __ARCH_WANT_SYS_SIGPROCMASK
|
||||
|
||||
asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
|
||||
compat_old_sigset_t __user *oset)
|
||||
/*
|
||||
* sys_sigprocmask SIG_SETMASK sets the first (compat) word of the
|
||||
* blocked set of signals to the supplied signal set
|
||||
*/
|
||||
static inline void compat_sig_setmask(sigset_t *blocked, compat_sigset_word set)
|
||||
{
|
||||
old_sigset_t s;
|
||||
long ret;
|
||||
mm_segment_t old_fs;
|
||||
memcpy(blocked->sig, &set, sizeof(set));
|
||||
}
|
||||
|
||||
if (set && get_user(s, set))
|
||||
return -EFAULT;
|
||||
old_fs = get_fs();
|
||||
set_fs(KERNEL_DS);
|
||||
ret = sys_sigprocmask(how,
|
||||
set ? (old_sigset_t __user *) &s : NULL,
|
||||
oset ? (old_sigset_t __user *) &s : NULL);
|
||||
set_fs(old_fs);
|
||||
if (ret == 0)
|
||||
if (oset)
|
||||
ret = put_user(s, oset);
|
||||
return ret;
|
||||
asmlinkage long compat_sys_sigprocmask(int how,
|
||||
compat_old_sigset_t __user *nset,
|
||||
compat_old_sigset_t __user *oset)
|
||||
{
|
||||
old_sigset_t old_set, new_set;
|
||||
sigset_t new_blocked;
|
||||
|
||||
old_set = current->blocked.sig[0];
|
||||
|
||||
if (nset) {
|
||||
if (get_user(new_set, nset))
|
||||
return -EFAULT;
|
||||
new_set &= ~(sigmask(SIGKILL) | sigmask(SIGSTOP));
|
||||
|
||||
new_blocked = current->blocked;
|
||||
|
||||
switch (how) {
|
||||
case SIG_BLOCK:
|
||||
sigaddsetmask(&new_blocked, new_set);
|
||||
break;
|
||||
case SIG_UNBLOCK:
|
||||
sigdelsetmask(&new_blocked, new_set);
|
||||
break;
|
||||
case SIG_SETMASK:
|
||||
compat_sig_setmask(&new_blocked, new_set);
|
||||
break;
|
||||
default:
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
set_current_blocked(&new_blocked);
|
||||
}
|
||||
|
||||
if (oset) {
|
||||
if (put_user(old_set, oset))
|
||||
return -EFAULT;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
#endif
|
||||
|
|
Loading…
Reference in a new issue