On Tue, 21 May 2019, Eric W. Biederman wrote: > The usb support for asyncio encoded one of it's values in the wrong > field. It should have used si_value but instead used si_addr which is > not present in the _rt union member of struct siginfo. > > The practical result of this is that on a 64bit big endian kernel > when delivering a signal to a 32bit process the si_addr field > is set to NULL, instead of the expected pointer value. > > This issue can not be fixed in copy_siginfo_to_user32 as the usb > usage of the the _sigfault (aka si_addr) member of the siginfo > union when SI_ASYNCIO is set is incompatible with the POSIX and > glibc usage of the _rt member of the siginfo union. > > Therefore replace kill_pid_info_as_cred with kill_pid_usb_asyncio a > dedicated function for this one specific case. There are no other > users of kill_pid_info_as_cred so this specialization should have no > impact on the amount of code in the kernel. Have kill_pid_usb_asyncio > take instead of a siginfo_t which is difficult and error prone, 3 > arguments, a signal number, an errno value, and an address enconded as > a sigval_t. The encoding of the address as a sigval_t allows the > code that reads the userspace request for a signal to handle this > compat issue along with all of the other compat issues. > > Add BUILD_BUG_ONs in kernel/signal.c to ensure that we can now place > the pointer value at the in si_pid (instead of si_addr). That is the > code now verifies that si_pid and si_addr always occur at the same > location. Further the code veries that for native structures a value > placed in si_pid and spilling into si_uid will appear in userspace in > si_addr (on a byte by byte copy of siginfo or a field by field copy of > siginfo). The code also verifies that for a 64bit kernel and a 32bit > userspace the 32bit pointer will fit in si_pid. Okay, I have gone through this. Although I still don't really understand the detailed issues concerning the layout of the data fields (probably hopeless without seeing a diagram), the USB portions of the patch look good and do what the patch description says. Acked-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx> Alan Stern
