[PATCH] posix-timers: Prevent broadcast signals

[PATCH] posix-timers: Prevent broadcast signals

[Sebastian Andrzej Siewior]

From: Thomas Gleixner <tglx@linutronix.de>

Posix timers should not send broadcast signals and kernel only
signals. Prevent it.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
---
 kernel/time/posix-timers.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index b6899b5060bd..4c4cbebb0d71 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -435,6 +435,7 @@ static enum hrtimer_restart posix_timer_fn(struct hrtimer *timer)
 static struct pid *good_sigevent(sigevent_t * event)
 {
 	struct task_struct *rtn = current->group_leader;
+	int sig = event->sigev_signo;
 
 	switch (event->sigev_notify) {
 	case SIGEV_SIGNAL | SIGEV_THREAD_ID:
@@ -444,7 +445,8 @@ static struct pid *good_sigevent(sigevent_t * event)
 		/* FALLTHRU */
 	case SIGEV_SIGNAL:
 	case SIGEV_THREAD:
-		if (event->sigev_signo <= 0 || event->sigev_signo > SIGRTMAX)
+		if (sig <= 0 || sig > SIGRTMAX ||
+		    sig_kernel_only(sig) || sig_kernel_coredump(sig))
 			return NULL;
 		/* FALLTHRU */
 	case SIGEV_NONE:
-- 
2.17.0

Re: [PATCH] posix-timers: Prevent broadcast signals

[Eric W. Biederman]

Sebastian Andrzej Siewior <bigeasy@linutronix.de> writes:

> From: Thomas Gleixner <tglx@linutronix.de>
>
> Posix timers should not send broadcast signals and kernel only
> signals. Prevent it.

You are not adding prevention of ``broadcast'' signals by preventing
sig_kernel_only and sig_kernel_coredump so your change description does
not make sense.

Second we are sending the signal to ourselves.  It may be silly to use
a timer to send SIGKILL or SIGSTOP but I can imagine some reasons.

For signals that might coredump if you setup a handler they won't
coredump so preventing those seems even sillier.

So what is the reason for changing which signals posix timers send?

If SIGEV_THREAD_ID is specificied I can understand not wanting
to send signals that could affect more than just a thread.

if SIGEV_THREAD is specified I can understand not wanting signals
that will do more than wake up the thread.  I presume glibc precreates
the thread.

Neither of those cases should apply to everything passing through
good_sigevent.  So your code is wrong if those are your justification.

Further the kernel is perfectly capable of delivering all types of
signal through send_sigqueue so there is no techincal reason for
preventing these signals.

Eric


> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> ---
>  kernel/time/posix-timers.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
> index b6899b5060bd..4c4cbebb0d71 100644
> --- a/kernel/time/posix-timers.c
> +++ b/kernel/time/posix-timers.c
> @@ -435,6 +435,7 @@ static enum hrtimer_restart posix_timer_fn(struct hrtimer *timer)
>  static struct pid *good_sigevent(sigevent_t * event)
>  {
>  	struct task_struct *rtn = current->group_leader;
> +	int sig = event->sigev_signo;
>  
>  	switch (event->sigev_notify) {
>  	case SIGEV_SIGNAL | SIGEV_THREAD_ID:
> @@ -444,7 +445,8 @@ static struct pid *good_sigevent(sigevent_t * event)
>  		/* FALLTHRU */
>  	case SIGEV_SIGNAL:
>  	case SIGEV_THREAD:
> -		if (event->sigev_signo <= 0 || event->sigev_signo > SIGRTMAX)
> +		if (sig <= 0 || sig > SIGRTMAX ||
> +		    sig_kernel_only(sig) || sig_kernel_coredump(sig))
>  			return NULL;
>  		/* FALLTHRU */
>  	case SIGEV_NONE: