linux-kernel - Re: [PATCH] signal/posixtimers: Handle ignore/blocked sequences correctly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z2Vr1_85NucYkBaP@pavilion.home>
Date: Fri, 20 Dec 2024 14:06:31 +0100
From: Frederic Weisbecker <frederic@...nel.org>
To: Thomas Gleixner <tglx@...utronix.de>
Cc: syzbot <syzbot+3c2e3cc60665d71de2f7@...kaller.appspotmail.com>,
	anna-maria@...utronix.de, linux-kernel@...r.kernel.org,
	peterz@...radead.org, syzkaller-bugs@...glegroups.com,
	Eric Biederman <ebiederm@...ssion.com>,
	Oleg Nesterov <oleg@...hat.com>
Subject: Re: [PATCH] signal/posixtimers: Handle ignore/blocked sequences
 correctly

Le Thu, Dec 19, 2024 at 08:46:25PM +0100, Thomas Gleixner a écrit :
>  kernel/signal.c |   38 +++++++++++++++++++++++++++++---------
>  1 file changed, 29 insertions(+), 9 deletions(-)
> 
> --- a/kernel/signal.c
> +++ b/kernel/signal.c
> @@ -2007,11 +2007,23 @@ void posixtimer_send_sigqueue(struct k_i
>  
>  		if (!list_empty(&q->list)) {
>  			/*
> -			 * If task group is exiting with the signal already pending,
> -			 * wait for __exit_signal() to do its job. Otherwise if
> -			 * ignored, it's not supposed to be queued. Try to survive.
> +			 * The signal was ignored and blocked. The timer
> +			 * expiry queued it because blocked signals are
> +			 * queued independent of the ignored state.
> +			 *
> +			 * The unblocking set SIGPENDING, but the signal
> +			 * was not yet dequeued from the pending list,
> +			 * which would have put it back on the ignore list.

I must be missing something. I don't see dequeue_signal() checking if a signal
is ignored upon delivery.

> +			 * So prepare_signal() sees unblocked and ignored,
> +			 * which ends up here. Leave it queued like a
> +			 * regular signal.
> +			 *
> +			 * The same happens when the task group is exiting
> +			 * and the signal is already queued.
> +			 * prepare_signal() treats SIGNAL_GROUP_EXIT as
> +			 * ignored independent of its queued state. This
> +			 * gets cleaned up in __exit_signal().
>  			 */
> -			WARN_ON_ONCE(!(t->signal->flags & SIGNAL_GROUP_EXIT));
>  			goto out;
>  		}
>  
> @@ -2046,17 +2058,25 @@ void posixtimer_send_sigqueue(struct k_i
>  		goto out;
>  	}
>  
> -	/* This should never happen and leaks a reference count */
> -	if (WARN_ON_ONCE(!hlist_unhashed(&tmr->ignored_list)))
> -		hlist_del_init(&tmr->ignored_list);
> -
>  	if (unlikely(!list_empty(&q->list))) {
>  		/* This holds a reference count already */
>  		result = TRACE_SIGNAL_ALREADY_PENDING;
>  		goto out;
>  	}
>  
> -	posixtimer_sigqueue_getref(q);
> +	/*
> +	 * If the signal is on the ignore list, it got blocked after it was
> +	 * ignored earlier. But nothing lifted the ignore. Move it back to
> +	 * the pending list to be consistent with the regular signal
> +	 * handling. If it gets unblocked, it will be ignored again unless

I'm not sure about that. If I follow the sigprocmask() path, set_task_blocked()
doesn't take care about that. And later on, dequeue_signal() doesn't seem to
check either...

Thanks.

> +	 * a handler has been installed before unblocking. If it's not on
> +	 * the ignore list acquire a reference count.
> +	 */
> +	if (likely(hlist_unhashed(&tmr->ignored_list)))
> +		posixtimer_sigqueue_getref(q);
> +	else
> +		hlist_del_init(&tmr->ignored_list);
> +
>  	posixtimer_queue_sigqueue(q, t, tmr->it_pid_type);
>  	result = TRACE_SIGNAL_DELIVERED;
>  out: