+ fork-dont-copy-inconsistent-signal-handler-state-to-child.patch added to -mm tree

[akpm@xxxxxxxxxxxxxxxxxxxx]

The patch titled
     Subject: fork: don't copy inconsistent signal handler state to child
has been added to the -mm tree.  Its filename is
     fork-dont-copy-inconsistent-signal-handler-state-to-child.patch

This patch should soon appear at
    http://ozlabs.org/~akpm/mmots/broken-out/fork-dont-copy-inconsistent-signal-handler-state-to-child.patch
and later at
    http://ozlabs.org/~akpm/mmotm/broken-out/fork-dont-copy-inconsistent-signal-handler-state-to-child.patch

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated
there every 3-4 working days

------------------------------------------------------
From: Jann Horn <jannh@xxxxxxxxxx>
Subject: fork: don't copy inconsistent signal handler state to child

Before this change, if a multithreaded process forks while one of its
threads is changing a signal handler using sigaction(), the memcpy() in
copy_sighand() can race with the struct assignment in do_sigaction().  It
isn't clear whether this can cause corruption of the userspace signal
handler pointer, but it definitely can cause inconsistency between
different fields of struct sigaction.

Take the appropriate spinlock to avoid this.

I have tested that this patch prevents inconsistency between sa_sigaction
and sa_flags, which is possible before this patch.

Link: http://lkml.kernel.org/r/20180702145108.73189-1-jannh@xxxxxxxxxx
Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
Acked-by: Michal Hocko <mhocko@xxxxxxxx>
Reviewed-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Cc: Rik van Riel <riel@xxxxxxxxxx>
Cc: "Peter Zijlstra (Intel)" <peterz@xxxxxxxxxxxxx>
Cc: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Oleg Nesterov <oleg@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---

 kernel/fork.c |    2 ++
 1 file changed, 2 insertions(+)

diff -puN kernel/fork.c~fork-dont-copy-inconsistent-signal-handler-state-to-child kernel/fork.c
--- a/kernel/fork.c~fork-dont-copy-inconsistent-signal-handler-state-to-child
+++ a/kernel/fork.c
@@ -1398,7 +1398,9 @@ static int copy_sighand(unsigned long cl
 		return -ENOMEM;
 
 	atomic_set(&sig->count, 1);
+	spin_lock_irq(&current->sighand->siglock);
 	memcpy(sig->action, current->sighand->action, sizeof(sig->action));
+	spin_unlock_irq(&current->sighand->siglock);
 	return 0;
 }
 
_

Patches currently in -mm which might be from jannh@xxxxxxxxxx are

fork-dont-copy-inconsistent-signal-handler-state-to-child.patch

--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html