linux-kernel - Re: [RT BUG] Mismatched get_uid/free_uid usage in signals in some rts (2nd try)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 26 Jun 2022 08:30:19 -0400
From:   Joe Korty <joe.korty@...current-rt.com>
To:     Mark Gross <markgross@...nel.org>
Cc:     "Luis Claudio R. Goncalves" <lgoncalv@...hat.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Linux RT users <linux-rt-users@...r.kernel.org>,
        Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        Thomas Gleixner <tglx@...utronix.de>,
        Steven Rostedt <rostedt@...dmis.org>
Subject: Re: [RT BUG] Mismatched get_uid/free_uid usage in signals in some
 rts (2nd try)

On Fri, Jun 24, 2022 at 02:44:31PM -0400, Joe Korty wrote:
> [ Fixed incorrect linux-rt-users email address in CC ]
> 
> On Fri, Jun 24, 2022 at 09:58:07AM -0700, Mark Gross wrote:
> > On Tue, Jun 21, 2022 at 03:16:39PM +0000, Joe Korty wrote:
> > > Mismatched get_uid/free_uid usage in signals in 4.9.312-rt193
> > >
> > >      [  First attempt using mutt did not show up on the mailing lists.
> > >         Trying again with office365 Outlook.   Also added the 4.9-rt
> > >         maintainers. ]
> > >
> > > The 4.19-rt patch,
> > >
> > >    0329-signal-Prevent-double-free-of-user-struct.patch
> > >
> > > needs to be ported to LAG 4.9-rt, as that release now has the Linus commit,
> > What does LAG stand for?
> 
> Hi Mark,
> LAG = Latest and Greatest
> 
> 
> 
> > FWIW the cherry-pick within the RT-stable tree worked without conflict.
> >     (cherry picked from commit a99e09659e6cd4b633c3689f2c3aa5f8a816fe5b)
> > It compiles.
> > See 58a584ee59b2 signal: Prevent double-free of user struct in
> > linux-stable-rt.git/v4.9-rt-next


Hi Mark,
Absent an actual test of your port of a99e09659e6c to 4.9-rt, I just
eye-verified that the change it makes to sigqueue_free_current looks
correct.  In detail,

  matches the same change the Linus patch makes to __sigqueue_free (ie,
  to the routine that sigqueue_free_current is a copy of).

  That the new variable 'up', in sigqueue_free_current, is being used
  in the patch (some variants of this fix do not have 'up'), and that
  variable is present in 4.9's version of sigqueue_free_current.
  
  That atomic_dec_and_test, rather than the refcounting version of that
  some function, is being used (some versions of this patch are refcounted
  instead).
  
Regards,
Joe