From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-eopbgr690114.outbound.protection.outlook.com ([40.107.69.114]:18358 "EHLO NAM04-CO1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1725836AbeH3WEc (ORCPT ); Thu, 30 Aug 2018 18:04:32 -0400 From: Sasha Levin To: "stable@vger.kernel.org" CC: Jann Horn , Rik van Riel , "Peter Zijlstra (Intel)" , Kees Cook , Oleg Nesterov , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH AUTOSEL 4.18 005/113] fork: don't copy inconsistent signal handler state to child Date: Thu, 30 Aug 2018 18:01:10 +0000 Message-ID: <20180830180050.35735-5-alexander.levin@microsoft.com> References: <20180830180050.35735-1-alexander.levin@microsoft.com> In-Reply-To: <20180830180050.35735-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Jann Horn [ Upstream commit 06e62a46bbba20aa5286102016a04214bb446141 ] Before this change, if a multithreaded process forks while one of its threads is changing a signal handler using sigaction(), the memcpy() in copy_sighand() can race with the struct assignment in do_sigaction(). It isn't clear whether this can cause corruption of the userspace signal handler pointer, but it definitely can cause inconsistency between different fields of struct sigaction. Take the appropriate spinlock to avoid this. I have tested that this patch prevents inconsistency between sa_sigaction and sa_flags, which is possible before this patch. Link: http://lkml.kernel.org/r/20180702145108.73189-1-jannh@google.com Signed-off-by: Jann Horn Acked-by: Michal Hocko Reviewed-by: Andrew Morton Cc: Rik van Riel Cc: "Peter Zijlstra (Intel)" Cc: Kees Cook Cc: Oleg Nesterov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- kernel/fork.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/fork.c b/kernel/fork.c index 1b27babc4c78..9cf8add7038d 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1417,7 +1417,9 @@ static int copy_sighand(unsigned long clone_flags, st= ruct task_struct *tsk) return -ENOMEM; =20 atomic_set(&sig->count, 1); + spin_lock_irq(¤t->sighand->siglock); memcpy(sig->action, current->sighand->action, sizeof(sig->action)); + spin_unlock_irq(¤t->sighand->siglock); return 0; } =20 --=20 2.17.1