linux-kernel - Re: [BUG] signal: multithread program returns with wrong errno on receiving SIGSTOP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 28 May 2007 11:07:53 +0400
From:	Oleg Nesterov <oleg@...sign.ru>
To:	Satoru Takeuchi <takeuchi_satoru.jp@...itsu.com>
Cc:	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Andrew Morton <akpm@...ux-foundation.org>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Ingo Molnar <mingo@...e.hu>,
	Roland McGrath <roland@...hat.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [BUG] signal: multithread program returns with wrong errno on receiving SIGSTOP

Satoru Takeuchi wrote:
>
> I found a bug on signal subsystem. If there is some multithread program
> and one of the thread is blocking on the system call, it returns with
> wrong errno on receiving SIGSTOP and following SIGCONT.

It doesn't matter in this particular case, but in general it is good to
report the kernel version as well.

> 1. issue the test program (attached on this mail) from term A.
>
>    $ ./mt-wrong-errno
>
> 2. send SIGSTOP to test program from term B.
>
>    $ ps a
>    ...
>     9685 pts/3    Sl+    0:00 ./mt-wrong-errno
>     9688 pts/4    R+     0:00 ps a
>    $ kill -STOP 9685
>
> 3. send SIGCONT to test program from term B.
>
>    $ kill -CONT 9685
>
> Expected Result
> ===============
>
> `./mt-wrong-errno' restarts read syscall (and stop again by receiving
> SIGTTIN).
>
> Actual Result
> =============
>
> `./mt-wrong-errno' returns with wrong errno 512 means ERESTARTSYS.
> The comment on include/linux/errno.h says "this errno should never be
> seen by user program." So it's definitely a bug.

Wild guess,

	drivers/char/n_tty.c:job_control()

		kill_pgrp(task_pgrp(current), SIGTTIN, 1);
		return -ERESTARTSYS;

This is wrong. kill_pgrp()->__group_send_sig_info() sends SIGTTIN
to the thread group, but can choose any sub-thread as a target for
signal_wake_up().

This means we return ERESTARTSYS, but signal_pending() != true, bug.

Satoru, could you re-test with the untested patch below?

Oleg.

--- t/drivers/char/n_tty.c~	2007-04-05 12:18:26.000000000 +0400
+++ t/drivers/char/n_tty.c	2007-05-28 10:57:58.000000000 +0400
@@ -1191,6 +1191,7 @@ static int job_control(struct tty_struct
 			    is_current_pgrp_orphaned())
 				return -EIO;
 			kill_pgrp(task_pgrp(current), SIGTTIN, 1);
+			set_thread_flag(TIF_SIGPENDING);
 			return -ERESTARTSYS;
 		}
 	}

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/