Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b7dafa0e authored by Jan Kiszka's avatar Jan Kiszka Committed by Linus Torvalds
Browse files

compat: Fix RT signal mask corruption via sigprocmask 



compat_sys_sigprocmask reads a smaller signal mask from userspace than
sigprogmask accepts for setting.  So the high word of blocked.sig[0]
will be cleared, releasing any potentially blocked RT signal.

This was discovered via userspace code that relies on get/setcontext.
glibc's i386 versions of those functions use sigprogmask instead of
rt_sigprogmask to save/restore signal mask and caused RT signal
unblocking this way.

As suggested by Linus, this replaces the sys_sigprocmask based compat
version with one that open-codes the required logic, including the merge
of the existing blocked set with the new one provided on SIG_SETMASK.

Signed-off-by: default avatarJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 7ee94d97

kernel/compat.c

+46 −17
Original line number Diff line number Diff line
@@ -372,25 +372,54 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set) 


#ifdef __ARCH_WANT_SYS_SIGPROCMASK



asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,

/*

 * sys_sigprocmask SIG_SETMASK sets the first (compat) word of the

 * blocked set of signals to the supplied signal set

 */

static inline void compat_sig_setmask(sigset_t *blocked, compat_sigset_word set)

{

	memcpy(blocked->sig, &set, sizeof(set));

}



asmlinkage long compat_sys_sigprocmask(int how,

				       compat_old_sigset_t __user *nset,

				       compat_old_sigset_t __user *oset)

{

	old_sigset_t s;

	long ret;

	mm_segment_t old_fs;

	old_sigset_t old_set, new_set;

	sigset_t new_blocked;



	old_set = current->blocked.sig[0];



	if (set && get_user(s, set))

	if (nset) {

		if (get_user(new_set, nset))

			return -EFAULT;

	old_fs = get_fs();

	set_fs(KERNEL_DS);

	ret = sys_sigprocmask(how,

			      set ? (old_sigset_t __user *) &s : NULL,

			      oset ? (old_sigset_t __user *) &s : NULL);

	set_fs(old_fs);

	if (ret == 0)

		if (oset)

			ret = put_user(s, oset);

	return ret;

		new_set &= ~(sigmask(SIGKILL) | sigmask(SIGSTOP));



		new_blocked = current->blocked;



		switch (how) {

		case SIG_BLOCK:

			sigaddsetmask(&new_blocked, new_set);

			break;

		case SIG_UNBLOCK:

			sigdelsetmask(&new_blocked, new_set);

			break;

		case SIG_SETMASK:

			compat_sig_setmask(&new_blocked, new_set);

			break;

		default:

			return -EINVAL;

		}



		set_current_blocked(&new_blocked);

	}



	if (oset) {

		if (put_user(old_set, oset))

			return -EFAULT;

	}



	return 0;

}



#endif