• Oleg Nesterov's avatar
    posix-timers: fix posix_timer_event() vs dequeue_signal() race · ba661292
    Oleg Nesterov authored
    The bug was reported and analysed by Mark McLoughlin <markmc@redhat.com>,
    the patch is based on his and Roland's suggestions.
    
    posix_timer_event() always rewrites the pre-allocated siginfo before sending
    the signal. Most of the written info is the same all the time, but memset(0)
    is very wrong. If ->sigq is queued we can race with collect_signal() which
    can fail to find this siginfo looking at .si_signo, or copy_siginfo() can
    copy the wrong .si_code/si_tid/etc.
    
    In short, sys_timer_settime() can in fact stop the active timer, or the user
    can receive the siginfo with the wrong .si_xxx values.
    
    Move "memset(->info, 0)" from posix_timer_event() to alloc_posix_timer(),
    change send_sigqueue() to set .si_overrun = 0 when ->sigq is not queued.
    It would be nice to move the whole sigq->info initialization from send to
    create path, but this is not easy to do without uglifying timer_create()
    further.
    
    As Roland rightly pointed out, we need more cleanups/fixes here, see the
    "FIXME" comment in the patch. Hopefully this patch makes sense anyway, and
    it can mask the most bad implications.
    Reported-by: default avatarMark McLoughlin <markmc@redhat.com>
    Signed-off-by: default avatarOleg Nesterov <oleg@tv-sign.ru>
    Cc: Mark McLoughlin <markmc@redhat.com>
    Cc: Oliver Pinter <oliver.pntr@gmail.com>
    Cc: Roland McGrath <roland@redhat.com>
    Cc: stable@kernel.org
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    
     kernel/posix-timers.c |   17 +++++++++++++----
     kernel/signal.c       |    1 +
     2 files changed, 14 insertions(+), 4 deletions(-)
    ba661292
posix-timers.c 29.5 KB