linux-kernel - SIGIO after RT signal queue full issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 7 Nov 2013 15:26:21 -0500 (EST)
From:	Vince Weaver <vincent.weaver@...ne.edu>
To:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
cc:	Alexander Viro <viro@...iv.linux.org.uk>,
	Oleg Nesterov <oleg@...hat.com>
Subject: SIGIO after RT signal queue full issues

Hello

I have a program that generates a lot of signals (perf_event_open 
overflows).  The signals are set up to be RT signals with sigaction().

The program sometimes gets enough signals that the RT signal queues fill 
up.  In that case the kernel responds by ignoring the signal settings
and unconditionally sends a SIGIO.

The code that does this is (I think) in fs/fcntl.h, line 472

		if (!do_send_sig_info(signum, &si, p, group))
			break;
	/* fall-through: fall back on the old plain SIGIO signal */
	case 0:
		do_send_sig_info(SIGIO, SEND_SIG_PRIV, p, group);

The probelm is this SIGIO is sent ignoring the 
  sa_flags = SA_SIGINFO;
setting.  So the si_fd value isn't set, making it hard to tell which
fd has overflowed (which would be useful so I could shut down the
offending fd to stop the signal flood).

Is this the expected behavior?  It dates back to pre-git.

A related issue:
If I try to read the si->si_fd value anyway, I get garbage.
It seems that the code that implementes SEND_SIG_PRIV
only sets the uid and pid fields, and possibly is leaking kernel
state through the rest of the siginfo_t structure.

as best I can tell this happens in kernel/signal.c line 1106:

	case (unsigned long) SEND_SIG_PRIV:
		q->info.si_signo = sig;
		q->info.si_errno = 0;
		q->info.si_code = SI_KERNEL;
		q->info.si_pid = 0;
		q->info.si_uid = 0;
		break;

values past the pid and uid fields aren't zerod when read from the
siginfo_t field passed to the signal handler.
static void sigio_handler(int signum, siginfo_t *info, void *uc);

Thanks,

Vince
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/