Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2ffb448c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull timer fix from Thomas Gleixner:
 "A single bugfix which prevents arbitrary sigev_notify values in
  posix-timers"

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  posix-timer: Properly check sigevent->sigev_notify
parents c4372790 cef31d9a

kernel/time/posix-timers.c

+17 −12
Original line number Diff line number Diff line
@@ -434,17 +434,22 @@ static struct pid *good_sigevent(sigevent_t * event) 
{

	struct task_struct *rtn = current->group_leader;



	if ((event->sigev_notify & SIGEV_THREAD_ID ) &&

		(!(rtn = find_task_by_vpid(event->sigev_notify_thread_id)) ||

		 !same_thread_group(rtn, current) ||

		 (event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_SIGNAL))

	switch (event->sigev_notify) {

	case SIGEV_SIGNAL | SIGEV_THREAD_ID:

		rtn = find_task_by_vpid(event->sigev_notify_thread_id);

		if (!rtn || !same_thread_group(rtn, current))

			return NULL;



	if (((event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) &&

	    ((event->sigev_signo <= 0) || (event->sigev_signo > SIGRTMAX)))

		/* FALLTHRU */

	case SIGEV_SIGNAL:

	case SIGEV_THREAD:

		if (event->sigev_signo <= 0 || event->sigev_signo > SIGRTMAX)

			return NULL;



		/* FALLTHRU */

	case SIGEV_NONE:

		return task_pid(rtn);

	default:

		return NULL;

	}

}



static struct k_itimer * alloc_posix_timer(void)
@@ -669,7 +674,7 @@ void common_timer_get(struct k_itimer *timr, struct itimerspec64 *cur_setting) 
	struct timespec64 ts64;

	bool sig_none;



	sig_none = (timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE;

	sig_none = timr->it_sigev_notify == SIGEV_NONE;

	iv = timr->it_interval;



	/* interval timer ? */
@@ -856,7 +861,7 @@ int common_timer_set(struct k_itimer *timr, int flags, 


	timr->it_interval = timespec64_to_ktime(new_setting->it_interval);

	expires = timespec64_to_ktime(new_setting->it_value);

	sigev_none = (timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE;

	sigev_none = timr->it_sigev_notify == SIGEV_NONE;



	kc->timer_arm(timr, expires, flags & TIMER_ABSTIME, sigev_none);

	timr->it_active = !sigev_none;