linux-kernel - [PATCH] Fix BUG: using smp_processor_id() in preemptible code in print_fatal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1233010818.14510.11.camel@localhost.localdomain>
Date:	Mon, 26 Jan 2009 15:00:18 -0800
From:	Ed Swierk <eswierk@...stanetworks.com>
To:	rml@...h9.net, linux-kernel@...r.kernel.org,
	kpreempt-tech@...ts.sourceforge.net
Subject: [PATCH] Fix BUG: using smp_processor_id() in preemptible code in
 print_fatal_signal()

With print-fatal-signals=1 on a kernel with CONFIG_PREEMPT=y, sending an
unexpected signal to a process causes a BUG: using smp_processor_id() in
preemptible code.

get_signal_to_deliver() releases the siglock before calling
print_fatal_signal(), which calls show_regs(), which calls
smp_processor_id(), which is not supposed to be called from a
preemptible thread.

Calling print_fatal_signal() before releasing the siglock avoids this
problem.

Signed-off-by: Ed Swierk <eswierk@...stanetworks.com>

---
Index: linux-2.6.27.4/kernel/signal.c
===================================================================
--- linux-2.6.27.4.orig/kernel/signal.c
+++ linux-2.6.27.4/kernel/signal.c
@@ -1848,6 +1848,11 @@ relock:
 			continue;
 		}
 
+		if (sig_kernel_coredump(signr) && print_fatal_signals) {
+			/* hold lock for smp_processor_id() */
+			print_fatal_signal(regs, info->si_signo);
+		}
+
 		spin_unlock_irq(&sighand->siglock);
 
 		/*
@@ -1856,8 +1861,6 @@ relock:
 		current->flags |= PF_SIGNALED;
 
 		if (sig_kernel_coredump(signr)) {
-			if (print_fatal_signals)
-				print_fatal_signal(regs, info->si_signo);
 			/*
 			 * If it was able to dump core, this kills all
 			 * other threads in the group and synchronizes with


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/