Messages in this thread Patch in this message | | | From | (Eric W. Biederman) | Date | Sat, 12 Jan 2019 11:43:01 -0600 | Subject | Re: Bug (since v4.20): integer underflow in known_siginfo_layout() when sig=0 |
| |
Eric Biggers <ebiggers@kernel.org> writes:
> Hi Eric, > > The following commit, which went into v4.20, introduced undefined behavior when > sys_rt_sigqueueinfo() is called with sig=0:
Ouch. Good catch.
It looks like the fix is just to do:
diff --git a/include/linux/signal.h b/include/linux/signal.h index f428e86f4800..b5d99482d3fe 100644 --- a/include/linux/signal.h +++ b/include/linux/signal.h @@ -388,7 +388,7 @@ extern bool unhandled_signal(struct task_struct *tsk, int sig); #endif #define siginmask(sig, mask) \ - ((sig) < SIGRTMIN && (rt_sigmask(sig) & (mask))) + ((sig) > 0 && (sig) < SIGRTMIN && (rt_sigmask(sig) & (mask))) #define SIG_KERNEL_ONLY_MASK (\ rt_sigmask(SIGKILL) | rt_sigmask(SIGSTOP))
As gcc is smart enough to combine those two range tests into a single comparison. That will ensure the undefined behavior does not byte anyone else.
I will see about whipping up a proper patch.
Eric
| |