Re: [RFC PATCH 1/2] tty: mediate TIOCSIG through task_kill LSM hooks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Passing SEND_SIG_PRIV (1) directly to the task_kill LSM hook causes a kernel panic when dereferenced by an eBPF LSM program.
--

commit 0444b1560acb73813cdf2e4fa3082c4f0aaf7e00
Author: Christopher Lusk <clusk@northecho.dev>

tty: mediate TIOCSIG through task_kill LSM hooks

This commit changes the pty_signal() function to invoke the task_kill LSM hook
before delivering signals to the process group. It introduces kill_pgrp_lsm()
and __kill_pgrp_info_filtered() to perform this check while holding
tasklist_lock.

Link: https://lore.kernel.org/r/56bffc24f3d0d08b45a686a48e99766b0a0821fa.1780614610.git.hexlabsecurity@proton.me

> diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
> index cc7f7091ed9a2..8f5eea156ce4c 100644
> --- a/drivers/tty/pty.c
> +++ b/drivers/tty/pty.c
[ ... ]
> @@ -195,10 +196,13 @@ static int pty_signal(struct tty_struct *tty, int sig)
>  	if (tty->link) {
>  		pgrp = tty_get_pgrp(tty->link);
>  		if (pgrp)
> -			kill_pgrp(pgrp, sig, 1);
> +			ret = kill_pgrp_lsm(pgrp, sig, 1);
>  		put_pid(pgrp);
>  	}
[ ... ]
> diff --git a/kernel/signal.c b/kernel/signal.c
> index a5e15bf09d319..758393b7257d6 100644
> --- a/kernel/signal.c
> +++ b/kernel/signal.c
[ ... ]
> @@ -1426,13 +1426,22 @@ int group_send_sig_info(int sig, struct kernel_siginfo *info,
[ ... ]
> +static int __kill_pgrp_info_filtered(int sig, struct kernel_siginfo *info,
> +				     struct pid *pgrp, bool check_lsm)
>  {
>  	struct task_struct *p = NULL;
>  	int ret = -ESRCH;
>  
>  	do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
> -		int err = group_send_sig_info(sig, info, p, PIDTYPE_PGID);
> +		int err = 0;
> +
> +		if (check_lsm) {
> +			rcu_read_lock();
> +			err = security_task_kill(p, info, sig, NULL);

[Severity: High]
Does this pass SEND_SIG_PRIV ((void *)1) directly to the task_kill LSM hook?

pty_signal() initiates this by calling kill_pgrp_lsm() with priv=1, which
translates to SEND_SIG_PRIV via __si_special(priv). This invalid pointer is
then passed directly as the `info` argument to security_task_kill().

When an eBPF LSM program is attached to bpf_lsm_task_kill, it receives `info`
as a PTR_TO_BTF_ID | PTR_TRUSTED pointer. The PTR_TRUSTED flag disables BPF's
PROBE_MEM fault protection, as the pointer is assumed safe to dereference.

If the eBPF program attempts to read info->si_signo, it will execute a normal
kernel memory load from address 0x1, causing an immediate kernel panic.

Before this patch, check_kill_permission() filtered out SEND_SIG_PRIV via
si_fromuser(), preventing it from ever reaching the LSM hook.

> +			rcu_read_unlock();
> +		}
> +		if (!err)
> +			err = group_send_sig_info(sig, info, p, PIDTYPE_PGID);
[ ... ]
> @@ -1886,6 +1900,18 @@ int kill_pgrp(struct pid *pid, int sig, int priv)
>  }
>  EXPORT_SYMBOL(kill_pgrp);
>  
> +int kill_pgrp_lsm(struct pid *pid, int sig, int priv)
> +{
> +	int ret;
> +
> +	read_lock(&tasklist_lock);
> +	ret = __kill_pgrp_info_filtered(sig, __si_special(priv), pid, true);
> +	read_unlock(&tasklist_lock);
> +
> +	return ret;
> +}
> +EXPORT_SYMBOL_GPL(kill_pgrp_lsm);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260913221958.839429-1-clusk@northecho.dev?part=1