From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AD4F32F7AD2 for ; Sat, 2 May 2026 14:13:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777731235; cv=none; b=FVEflXkNASMV6IOk74hpbpakyqA9BiqZlTO7LegXsO4yL8TplC7/Y8xaBAXPuoaH+BGmf1//Zqxmn4uwbcERaTYJOp3+QV52jgW9FkzkQxcpNl66DBFPrAOsroJ8ZxiklTxiVTDsIIwaFGGl3v2QsbL674Jwj3aEWWr6SBuf70I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777731235; c=relaxed/simple; bh=H5u5HrZFqkzMLQ/rpnsYU7B3b1EzFo/WIxJUeL5gn7c=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=DwazIvhFgFA8gKFNLFnK9GHIM6DTo3d1SW5haeBY6SzegEdXJQdiCt4d7hPboqAuyxn8q5M9s3ENd85hqqmmIx6bC4o8LSqB076FMCxYReKH0XGkbyI2GcLvWyjLXETjwsa7+hL04+aNsZc6HyEls94uZZfonRNXgdlQb+G5bN0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=O086ed4d; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="O086ed4d" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1777731232; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=zKtbA28gFEhjtaEV7nXpI5SLYB0l20t+9qhe44XcSXw=; b=O086ed4dWYdI+ZFz1o6LhU5W+3C+W6CAEY0wIouHnEph9Gb3evRugAxT5j+dMuQuaMAyrC eaxZyLCSriHpbKA/Qp1gR7EwWmUCm9ONDpucY2cYVpQ73Vy061aBLoChopKjKU4I4cEUUw 8wJTkUSbK0OJqSRelXcNKEt4J6VVnG8= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-57-av7iInqZPICuvLPc2nrklA-1; Sat, 02 May 2026 10:13:51 -0400 X-MC-Unique: av7iInqZPICuvLPc2nrklA-1 X-Mimecast-MFC-AGG-ID: av7iInqZPICuvLPc2nrklA_1777731230 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 2DD6B180049F; Sat, 2 May 2026 14:13:49 +0000 (UTC) Received: from fedora (unknown [10.44.48.11]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with SMTP id A06A430001A1; Sat, 2 May 2026 14:13:45 +0000 (UTC) Received: by fedora (nbSMTP-1.00) for uid 1000 oleg@redhat.com; Sat, 2 May 2026 16:13:49 +0200 (CEST) Date: Sat, 2 May 2026 16:13:44 +0200 From: Oleg Nesterov To: Andrew Morton Cc: Andy Lutomirski , Kees Cook , Kusaram Devineni , Peter Zijlstra , Thomas Gleixner , Will Drewry , linux-kernel@vger.kernel.org Subject: [PATCH v2 2/2] signal: prevent evasion of SA_IMMUTABLE signals Message-ID: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 force_sig_info_to_task(HANDLER_EXIT) sets SA_IMMUTABLE to ensure a forced fatal signal cannot be ignored or caught by userspace; it must always terminate the target. However, if get_signal() dequeues another synchronous signal first, and that signal has a handler and its sa_mask includes the fatal SA_IMMUTABLE signal, the task can return to userspace and survive. So dequeue_synchronous_signal() must always dequeue an SA_IMMUTABLE signal first. But it relies on the SI_FROMKERNEL() check and picks the first one it sees in pending->list, and thus we have the following problems: - If the same signal was already pending and blocked, the new siginfo with .si_code > 0 will be lost. Change __send_signal_locked() to bypass the legacy_queue() check in this case. - If force_sig_info_to_task() races with another synchronous/SI_FROMKERNEL signal, that signal can be picked first. Change __send_signal_locked() to add an SA_IMMUTABLE signal at the start of pending->list. - SA_IMMUTABLE implies override_rlimit == true, but GFP_ATOMIC can fail anyway. Change __send_signal_locked() to escalate to SIGKILL in this (very unlikely) case. Not perfect and perhaps deserves WARN() or pr_warn_ratelimited(), but better than nothing. However, unlike get_signal(), __send_signal_locked() can not rely on the k_sigaction.sa.sa_flags & SA_IMMUTABLE check; another signal with the same .si_signo can come before dequeue_synchronous_signal() dequeues the signal sent by force(HANDLER_EXIT). Say, send_sig_perf() from task_work_run(), and this signal is SI_FROMKERNEL() too. So this patch adds 2 helpers, mark_si_immutable() and unmark_si_immutable() for force_sig_info_to_task() and __send_signal_locked() to pass/check the "immutable" state of siginfo sent by HANDLER_EXIT. Signed-off-by: Oleg Nesterov --- kernel/signal.c | 35 ++++++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/kernel/signal.c b/kernel/signal.c index 75e277e24b52..5a5eeb04ac7a 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -1034,6 +1034,19 @@ static void complete_signal(int sig, struct task_struct *p, enum pid_type type) return; } +static inline void mark_si_immutable(struct kernel_siginfo *info) +{ + info->si_signo |= INT_MIN; /* sets MSB */ +} + +static inline bool unmark_si_immutable(struct kernel_siginfo *info) +{ + bool ret = !is_si_special(info) && (info->si_signo & INT_MIN); + if (ret) + info->si_signo &= ~INT_MIN; + return ret; +} + static inline bool legacy_queue(struct sigpending *signals, int sig) { return (sig < SIGRTMIN) && sigismember(&signals->signal, sig); @@ -1042,6 +1055,7 @@ static inline bool legacy_queue(struct sigpending *signals, int sig) static int __send_signal_locked(int sig, struct kernel_siginfo *info, struct task_struct *t, enum pid_type type, bool force) { + bool immutable = unmark_si_immutable(info); struct sigpending *pending; struct sigqueue *q; int override_rlimit; @@ -1055,12 +1069,12 @@ static int __send_signal_locked(int sig, struct kernel_siginfo *info, pending = (type != PIDTYPE_PID) ? &t->signal->shared_pending : &t->pending; /* - * Short-circuit ignored signals and support queuing - * exactly one non-rt signal, so that we can get more - * detailed information about the cause of the signal. + * Queue exactly one non-rt signal so that we can get more + * detailed information about the cause. But we must never + * lose the siginfo for an SA_IMMUTABLE signal. */ result = TRACE_SIGNAL_ALREADY_PENDING; - if (legacy_queue(pending, sig)) + if (legacy_queue(pending, sig) && !immutable) goto ret; result = TRACE_SIGNAL_DELIVERED; @@ -1087,7 +1101,12 @@ static int __send_signal_locked(int sig, struct kernel_siginfo *info, q = sigqueue_alloc(sig, t, GFP_ATOMIC, override_rlimit); if (q) { - list_add_tail(&q->list, &pending->list); + /* Ensure dequeue_synchronous_signal() sees SA_IMMUTABLE first */ + if (immutable) + list_add(&q->list, &pending->list); + else + list_add_tail(&q->list, &pending->list); + switch ((unsigned long) info) { case (unsigned long) SEND_SIG_NOINFO: clear_siginfo(&q->info); @@ -1130,6 +1149,9 @@ static int __send_signal_locked(int sig, struct kernel_siginfo *info, * send the signal, but the *info bits are lost. */ result = TRACE_SIGNAL_LOSE_INFO; + /* The task must not escape SA_IMMUTABLE; escalate to SIGKILL */ + if (immutable) + sig = SIGKILL; } out_set: @@ -1317,6 +1339,9 @@ force_sig_info_to_task(struct kernel_siginfo *info, struct task_struct *t, if (action->sa.sa_handler == SIG_DFL && (!t->ptrace || (handler == HANDLER_EXIT))) t->signal->flags &= ~SIGNAL_UNKILLABLE; + + if (handler == HANDLER_EXIT) + mark_si_immutable(info); ret = __send_signal_locked(sig, info, t, PIDTYPE_PID, false); /* This can happen if the signal was already pending and blocked */ if (!task_sigpending(t)) -- 2.52.0