Eric W. Biederman 60de9fffbe signal: Better detection of synchronous signals ... commit 7146db3317c67b517258cb5e1b08af387da0618b upstream. Recently syzkaller was able to create unkillablle processes by creating a timer that is delivered as a thread local signal on SIGHUP, and receiving SIGHUP SA_NODEFERER. Ultimately causing a loop failing to deliver SIGHUP but always trying. When the stack overflows delivery of SIGHUP fails and force_sigsegv is called. Unfortunately because SIGSEGV is numerically higher than SIGHUP next_signal tries again to deliver a SIGHUP. From a quality of implementation standpoint attempting to deliver the timer SIGHUP signal is wrong. We should attempt to deliver the synchronous SIGSEGV signal we just forced. We can make that happening in a fairly straight forward manner by instead of just looking at the signal number we also look at the si_code. In particular for exceptions (aka synchronous signals) the si_code is always greater than 0. That still has the potential to pick up a number of asynchronous signals as in a few cases the same si_codes that are used for synchronous signals are also used for asynchronous signals, and SI_KERNEL is also included in the list of possible si_codes. Still the heuristic is much better and timer signals are definitely excluded. Which is enough to prevent all known ways for someone sending a process signals fast enough to cause unexpected and arguably incorrect behavior. Cc: stable@vger.kernel.org Fixes: a27341cd5f ("Prioritize synchronous signals over 'normal' signals") Tested-by: Dmitry Vyukov <dvyukov@google.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-02-20 10:13:18 +01:00
..
bpf	bpf: Prevent memory disambiguation attack	2018-12-17 21:55:15 +01:00
configs	kconfig: tinyconfig: provide whole choice blocks to avoid warnings	2016-09-24 10:07:42 +02:00
debug	kdb: use memmove instead of overlapping memcpy	2018-12-13 09:21:29 +01:00
events	perf/core: Don't WARN() for impossible ring-buffer sizes	2019-02-20 10:13:17 +01:00
gcov	gcov: disable for COMPILE_TEST	2018-01-23 19:50:10 +01:00
irq	genirq: Fix race on spurious interrupt detection	2018-11-21 09:27:35 +01:00
livepatch	livepatch: x86: fix relocation computation with kASLR	2015-11-11 17:36:04 +01:00
locking	locking/lockdep: Fix debug_locks off performance problem	2018-11-21 09:27:31 +01:00
power	PM / sleep: wakeup: Fix build error caused by missing SRCU support	2018-09-09 20:04:34 +02:00
printk	printk: Fix panic caused by passing log_buf_len to command line	2018-11-21 09:27:35 +01:00
rcu	rcu: Force boolean subscript for expedited stall warnings	2019-02-08 11:25:33 +01:00
sched	sched/core: Allow __sched_setscheduler() in interrupts when PI is not used	2018-12-01 09:46:41 +01:00
time	timekeeping: Use proper seqcount initializer	2019-02-20 10:13:08 +01:00
trace	tracing: Fix memory leak of instance function hash filters	2018-12-21 14:09:51 +01:00
.gitignore	certs: add .gitignore to stop git nagging about x509_certificate_list	2015-10-21 15:18:35 +01:00
acct.c	kernel/acct.c: fix the acct->needcheck check in check_free_space()	2018-01-10 09:27:08 +01:00
async.c	kernel/async.c: revert "async: simplify lowest_in_progress()"	2018-02-16 20:09:45 +01:00
audit.c	audit: return on memory error to avoid null pointer dereference	2018-05-30 07:49:16 +02:00
audit.h	audit: audit_tree_match can be boolean	2015-11-04 08:23:51 -05:00
audit_fsnotify.c	audit: clean simple fsnotify implementation	2015-08-06 16:14:53 -04:00
audit_tree.c	audit: audit_tree_match can be boolean	2015-11-04 08:23:51 -05:00
audit_watch.c	audit: fix use-after-free in audit_add_watch	2018-09-26 08:35:08 +02:00
auditfilter.c	audit: allow not equal op for audit by executable	2018-08-06 16:24:38 +02:00
auditsc.c	audit: allow not equal op for audit by executable	2018-08-06 16:24:38 +02:00
backtracetest.c
bounds.c	kbuild: fix kernel/bounds.c 'W=1' warning	2018-11-21 09:27:35 +01:00
capability.c	exec: Ensure mm->user_ns contains the execed files	2017-01-06 11:16:14 +01:00
cgroup.c	cgroup: Fix deadlock in cpu hotplug path	2018-10-13 09:11:33 +02:00
cgroup_freezer.c	cgroup: fix handling of multi-destination migration from subtree_control enabling	2015-12-03 10:18:21 -05:00
cgroup_pids.c	cgroup_pids: don't account for the root cgroup	2015-12-03 10:18:21 -05:00
compat.c	compat: cleanup coding in compat_get_bitmap() and compat_put_bitmap()	2015-06-04 23:57:18 +02:00
configs.c
context_tracking.c	context_tracking: avoid irq_save/irq_restore on guest entry and exit	2015-11-10 12:06:23 +01:00
cpu.c	stable-fixup: hotplug: fix unused function warning	2017-01-12 11:22:48 +01:00
cpu_pm.c	kernel/cpu_pm: fix cpu_cluster_pm_exit comment	2015-09-03 02:42:20 +02:00
cpuset.c	sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs	2017-10-12 11:27:35 +02:00
crash_dump.c
cred.c	cred: Reject inodes with invalid ids in set_create_file_as()	2016-09-15 08:27:49 +02:00
delayacct.c
dma.c
elfcore.c
exec_domain.c	Remove rest of exec domains.	2015-04-12 21:03:31 +02:00
exit.c	kernel/exit.c: release ptraced tasks before zap_pid_ns_processes	2019-02-06 19:43:07 +01:00
extable.c	kernel/extable.c: mark core_kernel_text notrace	2017-07-21 07:44:56 +02:00
fork.c	fork: record start_time late	2019-01-13 10:05:32 +01:00
freezer.c
futex.c	futex: futex_wake_op, fix sign_extend32 sign bits	2018-05-26 08:48:51 +02:00
futex_compat.c	ptrace: use fsuid, fsgid, effective creds for fs access checks	2016-02-25 12:01:16 -08:00
groups.c	kernel: make groups_sort calling a responsibility group_info allocators	2018-01-10 09:27:10 +01:00
hung_task.c	kernel/hung_task.c: break RCU locks based on jiffies	2019-02-20 10:13:14 +01:00
irq_work.c	treewide: Remove old email address	2015-11-23 09:44:58 +01:00
jump_label.c	jump_label: Invoke jump_label_test() via early_initcall()	2017-12-16 10:33:55 +01:00
kallsyms.c
kcmp.c	ptrace: use fsuid, fsgid, effective creds for fs access checks	2016-02-25 12:01:16 -08:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks	locking/qrwlock: Rename QUEUE_RWLOCK to QUEUED_RWLOCKS	2015-05-12 09:46:00 +02:00
Kconfig.preempt
kexec.c	kexec: use file name as the output message prefix	2015-11-06 17:50:42 -08:00
kexec_core.c	kexec: use file name as the output message prefix	2015-11-06 17:50:42 -08:00
kexec_file.c	kexec: fix double-free when failing to relocate the purgatory	2016-09-24 10:07:36 +02:00
kexec_internal.h	kexec: split kexec_file syscall code to kexec_file.c	2015-09-10 13:29:01 -07:00
kmod.c	kmod: don't run async usermode helper as a child of kworker thread	2015-10-23 17:55:10 +09:00
kprobes.c	kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()	2018-11-21 09:27:32 +01:00
ksysfs.c	kexec: split kexec_load syscall from kexec core code	2015-09-10 13:29:01 -07:00
kthread.c	kthread, tracing: Don't expose half-written comm when creating kthreads	2018-09-09 20:04:34 +02:00
latencytop.c
Makefile	sys_membarrier(): system-wide memory barrier (generic, x86)	2015-09-11 15:21:34 -07:00
membarrier.c	Fix: Disable sys_membarrier when nohz_full is enabled	2017-03-12 06:37:26 +01:00
memremap.c	mm, devm_memremap_pages: kill mapping "System RAM" support	2019-01-13 10:05:32 +01:00
module-internal.h
module.c	module: exclude SHN_UNDEF symbols from kallsyms api	2018-10-10 08:52:07 +02:00
module_signing.c	KEYS: Merge the type-specific data with the payload data	2015-10-21 15:18:36 +01:00
notifier.c	Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-09-01 08:40:25 -07:00
nsproxy.c
padata.c	padata: free correct variable	2017-05-20 14:27:02 +02:00
panic.c	kernel/panic.c: add missing \n	2017-07-05 14:37:19 +02:00
params.c	Nothing exciting, minor tweaks and cleanups.	2015-11-09 15:53:39 -08:00
pid.c	pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()	2018-04-13 19:50:03 +02:00
pid_namespace.c	pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes	2017-05-25 14:30:11 +02:00
profile.c	profile: hide unused functions when !CONFIG_PROC_FS	2018-02-25 11:03:44 +01:00
ptrace.c	ptrace: Properly initialize ptracer_cred on fork	2017-06-14 13:16:20 +02:00
range.c
reboot.c	kexec: split kexec_load syscall from kexec core code	2015-09-10 13:29:01 -07:00
relay.c	kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE	2018-05-30 07:49:00 +02:00
resource.c	resource: fix integer overflow at reallocation	2018-04-24 09:32:05 +02:00
seccomp.c	seccomp: Move speculation migitation control to arch code	2018-07-25 10:18:27 +02:00
signal.c	signal: Better detection of synchronous signals	2019-02-20 10:13:18 +01:00
smp.c	mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd	2015-11-06 17:50:42 -08:00
smpboot.c	stop_machine: Kill smp_hotplug_thread->pre_unpark, introduce stop_machine_unpark()	2015-10-20 10:23:55 +02:00
smpboot.h
softirq.c
stacktrace.c
stop_machine.c	kernel: remove stop_machine() Kconfig dependency	2015-12-12 10:15:34 -08:00
sys.c	sys: don't hold uts_sem while accessing userspace memory	2018-09-09 20:04:35 +02:00
sys_ni.c	mm: mlock: add new mlock system call	2015-11-05 19:34:48 -08:00
sysctl.c	namei: allow restricted O_CREAT of FIFOs and regular files	2018-12-01 09:46:41 +01:00
sysctl_binary.c	fs/coredump: prevent fsuid=0 dumps into user-controlled directories	2016-04-12 09:08:58 -07:00
task_work.c	task_work: remove fifo ordering guarantee	2015-09-05 13:46:58 -07:00
taskstats.c
test_kprobes.c
torture.c	torture: Consolidate cond_resched_rcu_qs() into stutter_wait()	2015-10-06 11:25:01 -07:00
tracepoint.c	tracepoint: Do not warn on ENOMEM	2018-05-16 10:06:47 +02:00
tsacct.c
uid16.c	kernel: make groups_sort calling a responsibility group_info allocators	2018-01-10 09:27:10 +01:00
up.c
user-return-notifier.c
user.c
user_namespace.c	userns: move user access out of the mutex	2018-09-09 20:04:35 +02:00
utsname.c
utsname_sysctl.c	sys: don't hold uts_sem while accessing userspace memory	2018-09-09 20:04:35 +02:00
watchdog.c	kernel/watchdog: use nmi registers snapshot in hardlockup handler	2017-01-06 11:16:16 +01:00
workqueue.c	workqueue: use put_device() instead of kfree()	2018-05-30 07:49:04 +02:00
workqueue_internal.h	workqueue: Fix NULL pointer dereference	2017-11-15 17:13:11 +01:00