From mboxrd@z Thu Jan 1 00:00:00 1970 From: Oleg Nesterov Subject: [PATCH 1/1] CLONE_PARENT shouldn't allow to set ->exit_signal Date: Wed, 14 Mar 2012 19:55:38 +0100 Message-ID: <20120314185538.GB14172@redhat.com> References: <1331421919-15499-1-git-send-email-tixxdz@opendz.org> <1331421919-15499-2-git-send-email-tixxdz@opendz.org> <20120311172512.GA2729@redhat.com> <20120311174953.GB2729@redhat.com> <20120314185510.GA14172@redhat.com> Reply-To: kernel-hardening@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Djalal Harouni , Alan Cox , linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Al Viro , Alexey Dobriyan , "Eric W. Biederman" , Vasiliy Kulikov , Kees Cook , Solar Designer , WANG Cong , James Morris , linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, Greg KH , Ingo Molnar , Stephen Wilson , "Jason A. Donenfeld" , Roland McGrath To: Andrew Morton , Linus Torvalds Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: Content-Disposition: inline In-Reply-To: <20120314185510.GA14172@redhat.com> List-Id: linux-fsdevel.vger.kernel.org The child must not control its ->exit_signal, it is the parent who decides which signal the child should use for notification. This means that CLONE_PARENT should not use "clone_flags & CSIGNAL", the forking task is the sibling of the new process and their parent doesn't control exit_signal in this case. This patch uses ->exit_signal of the forking process, but perhaps we should simply use SIGCHLD. We read group_leader->exit_signal lockless, this can race with the ORIGINAL_SIGNAL -> SIGCHLD transition, but this is fine. Potentially this change allows to kill self_exec_id/parent_exec_id. Signed-off-by: Oleg Nesterov --- kernel/fork.c | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-) diff --git a/kernel/fork.c b/kernel/fork.c index b77fd55..34d7ed1 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1310,7 +1310,13 @@ static struct task_struct *copy_process(unsigned long clone_flags, clear_all_latency_tracing(p); /* ok, now we should be set up.. */ - p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL); + if (clone_flags & CLONE_THREAD) + p->exit_signal = -1; + else if (clone_flags & CLONE_PARENT) + p->exit_signal = current->group_leader->exit_signal; + else + p->exit_signal = (clone_flags & CSIGNAL); + p->pdeath_signal = 0; p->exit_state = 0; -- 1.5.5.1