lkml.org 
[lkml]   [2009]   [Feb]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH 1/2] copy_process: fix CLONE_PARENT && ->exit_signal interaction
clone(CLONE_PARENT | SIGXXX) blindly sets ->exit_signal = SIGXXX. It is not
clear to me what was the supposed behaviour but this does not look right.
The parent of the forking task will receive this signal which bypasses all
security checks.

With this patch CLONE_PARENT re-uses both ->real_parent and ->exit_signal,
this looks at least logical.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reported-by: Chris Evans <scarybeasts@gmail.com>

--- 6.29-rc3/kernel/fork.c~1_EXIT_SIGNAL 2009-02-09 01:03:48.000000000 +0100
+++ 6.29-rc3/kernel/fork.c 2009-02-25 18:09:56.000000000 +0100
@@ -1217,10 +1217,16 @@ static struct task_struct *copy_process(
!cpu_online(task_cpu(p))))
set_task_cpu(p, smp_processor_id());

- /* CLONE_PARENT re-uses the old parent */
- if (clone_flags & (CLONE_PARENT|CLONE_THREAD))
+ /* CLONE_PARENT re-uses the old parent and exit_signal */
+ if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
+ /*
+ * Do this under tasklist_lock to avoid the race with
+ * re-parenting to init.
+ */
+ if (!(clone_flags & CLONE_THREAD))
+ p->exit_signal = current->group_leader->exit_signal;
p->real_parent = current->real_parent;
- else
+ } else
p->real_parent = current;

spin_lock(&current->sighand->siglock);


\
 
 \ /
  Last update: 2009-02-25 20:15    [W:0.065 / U:0.756 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site