Re: + kernel-fork-validate-exit_signal-in-clone-syscall.patch added to mm-nonmm-unstable branch

[Oleg Nesterov <oleg@redhat.com>]

On 03/08, Andrew Morton wrote:
>
> From: Deepanshu Kartikey <kartikey406@gmail.com>
> Subject: kernel/fork: validate exit_signal in clone() syscall
> Date: Sat, 7 Mar 2026 12:12:02 +0530
>
> When a child process exits, it sends exit_signal to its parent via
> do_notify_parent().  The clone() syscall constructs exit_signal as:
>
>   (lower_32_bits(clone_flags) & CSIGNAL)
>
> CSIGNAL is 0xff, so values in the range 65-255 are possible.  However,
> valid_signal() only accepts signals up to _NSIG (64 on x86_64), causing a
> WARN_ON in do_notify_parent() when the process exits:
>
>   WARNING: kernel/signal.c:2174 do_notify_parent+0xc7e/0xd70

Aaah. Thanks Deepanshu! My bad, please see below.

> The comment above kernel_clone() states that callers are expected to
> validate exit_signal.

Yes, and man 2 clone says:

      The termination signal is specified in the low byte of flags (clone()) or in cl_args.exit_signal (clone3()).
      If no signal (i.e., zero) is specified, then the parent process is not signaled when the child terminates.

it doesn't document that nonzero non-valid signal acts as .exit_signal == 0.

> --- a/kernel/fork.c~kernel-fork-validate-exit_signal-in-clone-syscall
> +++ a/kernel/fork.c
> @@ -2800,7 +2800,8 @@ SYSCALL_DEFINE5(clone, unsigned long, cl
>  		.stack		= newsp,
>  		.tls		= tls,
>  	};
> -
> +	if (!valid_signal(args.exit_signal))
> +		return -EINVAL;
>  	return kernel_clone(&args);

Well, kernel_clone() has more users which doesn't validate .exit_signal,
say sys_ia32_clone().

we need to move the valid_signal() check from copy_clone_args_from_user()
to kernel_clone() or copy_process()...

So. This should fix my

	[PATCH] do_notify_parent: sanitize the valid_signal() checks
	https://lore.kernel.org/all/aZsfg0Y055yuAvsq@redhat.com/

do_notify_parent-sanitize-the-valid_signal-checks.patch in -mm tree.

Somehow I was very sure that copy_process() paths already have the valid_signal()
check but my memory fooled me.

But this is a user visible change which can cause other bug reports...
Perhaps we should revert do_notify_parent-sanitize-the-valid_signal-checks.patch
and this patch?

Even if I think that the new valid_signal() check "fixes" the undocumented
behaviour, unlikely there is a sane application which passes non-valid exit
signal to sys_clone(). But who knows...

Oleg.