linux-kernel - Re: [PATCH] signal: Don't send signals to tasks that don't exist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 17 Aug 2018 10:34:12 -0700
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Oleg Nesterov <oleg@...hat.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Wen Yang <wen.yang99@....com.cn>,
        majiang <ma.jiang@....com.cn>,
        "J. Bruce Fields" <bfields@...ldses.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
        syzbot <syzbot+1f371ca19b341a276761@...kaller.appspotmail.com>
Subject: Re: [PATCH] signal: Don't send signals to tasks that don't exist

On Wed, Aug 15, 2018 at 9:04 PM, Eric W. Biederman
<ebiederm@...ssion.com> wrote:
>
> Recently syzbot reported crashes in send_sigio_to_task and
> send_sigurg_to_task in linux-next.  Despite finding a reproducer
> syzbot apparently did not bisected this or otherwise track down the
> offending commit in linux-next.
>
> I happened to see this report and examined the code because I had
> recently changed these functions as part of making PIDTYPE_TGID a real
> pid type so that fork would does not need to restart when receiving a
> signal.  By examination I see that I spotted a bug in the code
> that could explain the reported crashes.
>
> When I took Oleg's suggestion and optimized send_sigurg and send_sigio
> to only send to a single task when type is PIDTYPE_PID or PIDTYPE_TGID
> I failed to handle pids that no longer point to tasks.  The macro
> do_each_pid_task simply iterates for zero iterations.  With pid_task
> an explicit NULL test is needed.
>
> Update the code to include the missing NULL test.
>
> Fixes: 019191342fec ("signal: Use PIDTYPE_TGID to clearly store where file signals will be sent")
> Reported-by: syzkaller-bugs@...glegroups.com

Since the commit does not contain the syzbot-provided Reported-by tag,
we need to tell syzbot that this is fixed explicitly:

#syz fix: signal: Don't send signals to tasks that don't exist

> Signed-off-by: "Eric W. Biederman" <ebiederm@...ssion.com>
> ---
>  fs/fcntl.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/fs/fcntl.c b/fs/fcntl.c
> index a04accf6847f..4137d96534a6 100644
> --- a/fs/fcntl.c
> +++ b/fs/fcntl.c
> @@ -791,7 +791,8 @@ void send_sigio(struct fown_struct *fown, int fd, int band)
>         if (type <= PIDTYPE_TGID) {
>                 rcu_read_lock();
>                 p = pid_task(pid, PIDTYPE_PID);
> -               send_sigio_to_task(p, fown, fd, band, type);
> +               if (p)
> +                       send_sigio_to_task(p, fown, fd, band, type);
>                 rcu_read_unlock();
>         } else {
>                 read_lock(&tasklist_lock);
> @@ -830,7 +831,8 @@ int send_sigurg(struct fown_struct *fown)
>         if (type <= PIDTYPE_TGID) {
>                 rcu_read_lock();
>                 p = pid_task(pid, PIDTYPE_PID);
> -               send_sigurg_to_task(p, fown, type);
> +               if (p)
> +                       send_sigurg_to_task(p, fown, type);
>                 rcu_read_unlock();
>         } else {
>                 read_lock(&tasklist_lock);
> --
> 2.17.1
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@...glegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/87k1orgdoo.fsf_-_%40xmission.com.
> For more options, visit https://groups.google.com/d/optout.