Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9e7c8f8c authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Paul Moore
Browse files

signals: don't abuse __flush_signals() in selinux_bprm_committed_creds() 



selinux_bprm_committed_creds()->__flush_signals() is not right, we
shouldn't clear TIF_SIGPENDING unconditionally. There can be other
reasons for signal_pending(): freezing(), JOBCTL_PENDING_MASK, and
potentially more.

Also change this code to check fatal_signal_pending() rather than
SIGNAL_GROUP_EXIT, it looks a bit better.

Now we can kill __flush_signals() before it finds another buggy user.

Note: this code looks racy, we can flush a signal which was sent after
the task SID has been updated.

Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
Signed-off-by: default avatarPaul Moore <pmoore@redhat.com>
parent cded3fff

include/linux/sched.h

+0 −1
Original line number Diff line number Diff line
@@ -2373,7 +2373,6 @@ extern void sched_dead(struct task_struct *p); 


extern void proc_caches_init(void);

extern void flush_signals(struct task_struct *);

extern void __flush_signals(struct task_struct *);

extern void ignore_signals(struct task_struct *);

extern void flush_signal_handlers(struct task_struct *, int force_default);

extern int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info);

kernel/signal.c

+4 −9
Original line number Diff line number Diff line
@@ -414,21 +414,16 @@ void flush_sigqueue(struct sigpending *queue) 
}



/*

 * Flush all pending signals for a task.

 * Flush all pending signals for this kthread.

 */

void __flush_signals(struct task_struct *t)

{

	clear_tsk_thread_flag(t, TIF_SIGPENDING);

	flush_sigqueue(&t->pending);

	flush_sigqueue(&t->signal->shared_pending);

}



void flush_signals(struct task_struct *t)

{

	unsigned long flags;



	spin_lock_irqsave(&t->sighand->siglock, flags);

	__flush_signals(t);

	clear_tsk_thread_flag(t, TIF_SIGPENDING);

	flush_sigqueue(&t->pending);

	flush_sigqueue(&t->signal->shared_pending);

	spin_unlock_irqrestore(&t->sighand->siglock, flags);

}

security/selinux/hooks.c

+4 −2
Original line number Diff line number Diff line
@@ -2416,10 +2416,12 @@ static void selinux_bprm_committed_creds(struct linux_binprm *bprm) 
		for (i = 0; i < 3; i++)

			do_setitimer(i, &itimer, NULL);

		spin_lock_irq(&current->sighand->siglock);

		if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {

			__flush_signals(current);

		if (!fatal_signal_pending(current)) {

			flush_sigqueue(&current->pending);

			flush_sigqueue(&current->signal->shared_pending);

			flush_signal_handlers(current, 1);

			sigemptyset(&current->blocked);

			recalc_sigpending();

		}

		spin_unlock_irq(&current->sighand->siglock);

	}