Messages in this thread Patch in this message | | | Date | Sun, 22 Mar 2020 12:09:01 +0100 | From | Oleg Nesterov <> | Subject | [PATCH] ipc/mqueue.c: change __do_notify() to bypass check_kill_permission() |
| |
Commit cc731525f26a ("signal: Remove kernel interal si_code magic") changed the value of SI_FROMUSER(SI_MESGQ), this means that mq_notify() no longer works if the sender doesn't have rights to send a signal.
Change __do_notify() to use do_send_sig_info() instead of kill_pid_info() to avoid check_kill_permission().
This needs the additional notify.sigev_signo != 0 check, shouldn't we change do_mq_notify() to deny sigev_signo == 0 ?
Reported-by: Yoji <yoji.fujihar.min@gmail.com> Fixes: cc731525f26a ("signal: Remove kernel interal si_code magic") Cc: stable <stable@vger.kernel.org> Signed-off-by: Oleg Nesterov <oleg@redhat.com> --- ipc/mqueue.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/ipc/mqueue.c b/ipc/mqueue.c index 49a05ba3000d..3145fae162c1 100644 --- a/ipc/mqueue.c +++ b/ipc/mqueue.c @@ -775,12 +775,15 @@ static void __do_notify(struct mqueue_inode_info *info) if (info->notify_owner && info->attr.mq_curmsgs == 1) { struct kernel_siginfo sig_i; + struct task_struct *task; switch (info->notify.sigev_notify) { case SIGEV_NONE: break; case SIGEV_SIGNAL: + /* do_mq_notify() accepts sigev_signo == 0, why?? */ + if (!info->notify.sigev_signo) + break; /* sends signal */ - clear_siginfo(&sig_i); sig_i.si_signo = info->notify.sigev_signo; sig_i.si_errno = 0; @@ -790,11 +793,13 @@ static void __do_notify(struct mqueue_inode_info *info) rcu_read_lock(); sig_i.si_pid = task_tgid_nr_ns(current, ns_of_pid(info->notify_owner)); - sig_i.si_uid = from_kuid_munged(info->notify_user_ns, current_uid()); + sig_i.si_uid = from_kuid_munged(info->notify_user_ns, + current_uid()); + task = pid_task(info->notify_owner, PIDTYPE_PID); + if (task) + do_send_sig_info(info->notify.sigev_signo, + &sig_i, task, PIDTYPE_TGID); rcu_read_unlock(); - - kill_pid_info(info->notify.sigev_signo, - &sig_i, info->notify_owner); break; case SIGEV_THREAD: set_cookie(info->notify_cookie, NOTIFY_WOKENUP); -- 2.25.1.362.g51ebf55
| |