Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 14 Mar 2012 19:55:38 +0100
From: Oleg Nesterov <oleg@...hat.com>
To: Andrew Morton <akpm@...ux-foundation.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Djalal Harouni <tixxdz@...ndz.org>, Alan Cox <alan@...rguk.ukuu.org.uk>,
        linux-kernel@...r.kernel.org, kernel-hardening@...ts.openwall.com,
        Al Viro <viro@...iv.linux.org.uk>,
        Alexey Dobriyan <adobriyan@...il.com>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Vasiliy Kulikov <segoon@...nwall.com>,
        Kees Cook <keescook@...omium.org>, Solar Designer <solar@...nwall.com>,
        WANG Cong <xiyou.wangcong@...il.com>,
        James Morris <james.l.morris@...cle.com>,
        linux-security-module@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        Greg KH <gregkh@...uxfoundation.org>, Ingo Molnar <mingo@...e.hu>,
        Stephen Wilson <wilsons@...rt.ca>,
        "Jason A. Donenfeld" <Jason@...c4.com>,
        Roland McGrath <roland@...k.frob.com>
Subject: [PATCH 1/1] CLONE_PARENT shouldn't allow to set ->exit_signal

The child must not control its ->exit_signal, it is the parent who
decides which signal the child should use for notification.

This means that CLONE_PARENT should not use "clone_flags & CSIGNAL",
the forking task is the sibling of the new process and their parent
doesn't control exit_signal in this case.

This patch uses ->exit_signal of the forking process, but perhaps
we should simply use SIGCHLD.

We read group_leader->exit_signal lockless, this can race with the
ORIGINAL_SIGNAL -> SIGCHLD transition, but this is fine.

Potentially this change allows to kill self_exec_id/parent_exec_id.

Signed-off-by: Oleg Nesterov <oleg@...hat.com>
---
 kernel/fork.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/kernel/fork.c b/kernel/fork.c
index b77fd55..34d7ed1 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1310,7 +1310,13 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 	clear_all_latency_tracing(p);
 
 	/* ok, now we should be set up.. */
-	p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL);
+	if (clone_flags & CLONE_THREAD)
+		p->exit_signal = -1;
+	else if (clone_flags & CLONE_PARENT)
+		p->exit_signal = current->group_leader->exit_signal;
+	else
+		p->exit_signal = (clone_flags & CSIGNAL);
+
 	p->pdeath_signal = 0;
 	p->exit_state = 0;
 
-- 
1.5.5.1


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.