[PATCH v2] signal: factor out the kernel reserved si_code check

[PATCH v2] signal: factor out the kernel reserved si_code check

[Bradley Morgan]

The check that prevents userspace from sending siginfo with si_code
values reserved to the kernel is duplicated across do_rt_sigqueueinfo(),
do_rt_tgsigqueueinfo() and do_pidfd_send_signal(). Move the check
into a helper so the rule lives in one place.

Signed-off-by: Bradley Morgan <include@grrlz.net>
---
Changes since v1:
  - use the wording Oleg suggested for the comment

 kernel/signal.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/kernel/signal.c b/kernel/signal.c
index fdee0b012a11..a5e15bf09d31 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3944,6 +3944,15 @@ static void prepare_kill_siginfo(int sig, struct kernel_siginfo *info,
 	info->si_uid = from_kuid_munged(current_user_ns(), current_uid());
 }
 
+/*
+ * Not even root can pretend to send SI_FROMKERNEL() signals.
+ * Nor can they impersonate kill()/tgkill(), which have si_pid/uid
+ */
+static bool si_code_reserved_to_kernel(int si_code)
+{
+	return si_code >= 0 || si_code == SI_TKILL;
+}
+
 /**
  *  sys_kill - send a signal to a process
  *  @pid: the PID of the process
@@ -4035,7 +4044,7 @@ static int do_pidfd_send_signal(struct pid *pid, int sig, enum pid_type type,
 
 		/* Only allow sending arbitrary signals to yourself. */
 		if ((task_pid(current) != pid || type > PIDTYPE_TGID) &&
-		    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL))
+		    si_code_reserved_to_kernel(kinfo.si_code))
 			return -EPERM;
 	} else {
 		prepare_kill_siginfo(sig, &kinfo, type);
@@ -4190,11 +4199,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int, sig)
 
 static int do_rt_sigqueueinfo(pid_t pid, int sig, kernel_siginfo_t *info)
 {
-	/* Not even root can pretend to send signals from the kernel.
-	 * Nor can they impersonate a kill()/tgkill(), which adds source info.
-	 */
-	if ((info->si_code >= 0 || info->si_code == SI_TKILL) &&
-	    (task_pid_vnr(current) != pid))
+	if (si_code_reserved_to_kernel(info->si_code) &&
+	    task_pid_vnr(current) != pid)
 		return -EPERM;
 
 	/* POSIX.1b doesn't mention process groups.  */
@@ -4237,11 +4243,8 @@ static int do_rt_tgsigqueueinfo(pid_t tgid, pid_t pid, int sig, kernel_siginfo_t
 	if (pid <= 0 || tgid <= 0)
 		return -EINVAL;
 
-	/* Not even root can pretend to send signals from the kernel.
-	 * Nor can they impersonate a kill()/tgkill(), which adds source info.
-	 */
-	if ((info->si_code >= 0 || info->si_code == SI_TKILL) &&
-	    (task_pid_vnr(current) != pid))
+	if (si_code_reserved_to_kernel(info->si_code) &&
+	    task_pid_vnr(current) != pid)
 		return -EPERM;
 
 	return do_send_specific(tgid, pid, sig, info);
-- 
2.47.3

Re: [PATCH v2] signal: factor out the kernel reserved si_code check

[Oleg Nesterov]

On 08/06, Bradley Morgan wrote:
>
> The check that prevents userspace from sending siginfo with si_code
> values reserved to the kernel is duplicated across do_rt_sigqueueinfo(),
> do_rt_tgsigqueueinfo() and do_pidfd_send_signal(). Move the check
> into a helper so the rule lives in one place.

> +/*
> + * Not even root can pretend to send SI_FROMKERNEL() signals.
> + * Nor can they impersonate kill()/tgkill(), which have si_pid/uid
> + */
> +static bool si_code_reserved_to_kernel(int si_code)
> +{
> +	return si_code >= 0 || si_code == SI_TKILL;
> +}

OK, Acked-by: Oleg Nesterov <oleg@redhat.com>


But can't resist... We already have SI_FROMUSER() and SI_FROMKERNEL()
both take the pointer to siginfo as an argument.

Now we also have si_code_reserved_to_kernel() which falls into the same
category, but it aceepts .si_code and the names don't match...

OK, nevermind. I can't suggest a better name. Even if we change the
new helper to take "kernel_siginfo_t *info" to match SI_FROMXXX macros.

Oleg.