tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'for-linus-20190912' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux

Pull clone3 fix from Christian Brauner:
"This is a last-minute bugfix for clone3() that should go in before we
release 5.3 with clone3().

clone3() did not verify that the exit_signal argument was set to a
valid signal. This can be used to cause a crash by specifying a signal
greater than NSIG. e.g. -1.

The commit from Eugene adds a check to copy_clone_args_from_user() to
verify that the exit signal is limited by CSIGNAL as with legacy
clone() and that the signal is valid. With this we don't get the
legacy clone behavior were an invalid signal could be handed down and
would only be detected and then ignored in do_notify_parent(). Users
of clone3() will now get a proper error right when they pass an
invalid exit signal. Note, that this is not a change in user-visible
behavior since no kernel with clone3() has been released yet"

* tag 'for-linus-20190912' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux:
fork: block invalid exit signals with clone3()

Linus Torvalds 98dcb386 95217783

+10
+10
kernel/fork.c
··· 2338 2338 * 2339 2339 * It copies the process, and if successful kick-starts 2340 2340 * it and waits for it to finish using the VM if required. 2341 + * 2342 + * args->exit_signal is expected to be checked for sanity by the caller. 2341 2343 */ 2342 2344 long _do_fork(struct kernel_clone_args *args) 2343 2345 { ··· 2563 2561 2564 2562 if (copy_from_user(&args, uargs, size)) 2565 2563 return -EFAULT; 2564 + 2565 + /* 2566 + * Verify that higher 32bits of exit_signal are unset and that 2567 + * it is a valid signal 2568 + */ 2569 + if (unlikely((args.exit_signal & ~((u64)CSIGNAL)) || 2570 + !valid_signal(args.exit_signal))) 2571 + return -EINVAL; 2566 2572 2567 2573 *kargs = (struct kernel_clone_args){ 2568 2574 .flags = args.flags,