posix-timer: Properly check sigevent->sigev_notify
commit cef31d9af908243421258f1df35a4a644604efbe upstream. timer_create() specifies via sigevent->sigev_notify the signal delivery for the new timer. The valid modes are SIGEV_NONE, SIGEV_SIGNAL, SIGEV_THREAD and (SIGEV_SIGNAL | SIGEV_THREAD_ID). The sanity check in good_sigevent() is only checking the valid combination for the SIGEV_THREAD_ID bit, i.e. SIGEV_SIGNAL, but if SIGEV_THREAD_ID is not set it accepts any random value. This has no real effects on the posix timer and signal delivery code, but it affects show_timer() which handles the output of /proc/$PID/timers. That function uses a string array to pretty print sigev_notify. The access to that array has no bound checks, so random sigev_notify cause access beyond the array bounds. Add proper checks for the valid notify modes and remove the SIGEV_THREAD_ID masking from various code pathes as SIGEV_NONE can never be set in combination with SIGEV_THREAD_ID. Reported-by: Eric Biggers <ebiggers3@gmail.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Reported-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: John Stultz <john.stultz@linaro.org> [bwh: Backported to 3.16: - Add sig_none variable in common_timer_get(), added earlier upstream - Adjust filename, context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This commit is contained in:
parent
d8bfd2f23b
commit
7116a83411
|
@ -498,17 +498,22 @@ static struct pid *good_sigevent(sigevent_t * event)
|
||||||
{
|
{
|
||||||
struct task_struct *rtn = current->group_leader;
|
struct task_struct *rtn = current->group_leader;
|
||||||
|
|
||||||
if ((event->sigev_notify & SIGEV_THREAD_ID ) &&
|
switch (event->sigev_notify) {
|
||||||
(!(rtn = find_task_by_vpid(event->sigev_notify_thread_id)) ||
|
case SIGEV_SIGNAL | SIGEV_THREAD_ID:
|
||||||
!same_thread_group(rtn, current) ||
|
rtn = find_task_by_vpid(event->sigev_notify_thread_id);
|
||||||
(event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_SIGNAL))
|
if (!rtn || !same_thread_group(rtn, current))
|
||||||
|
return NULL;
|
||||||
|
/* FALLTHRU */
|
||||||
|
case SIGEV_SIGNAL:
|
||||||
|
case SIGEV_THREAD:
|
||||||
|
if (event->sigev_signo <= 0 || event->sigev_signo > SIGRTMAX)
|
||||||
|
return NULL;
|
||||||
|
/* FALLTHRU */
|
||||||
|
case SIGEV_NONE:
|
||||||
|
return task_pid(rtn);
|
||||||
|
default:
|
||||||
return NULL;
|
return NULL;
|
||||||
|
}
|
||||||
if (((event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) &&
|
|
||||||
((event->sigev_signo <= 0) || (event->sigev_signo > SIGRTMAX)))
|
|
||||||
return NULL;
|
|
||||||
|
|
||||||
return task_pid(rtn);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
void posix_timers_register_clock(const clockid_t clock_id,
|
void posix_timers_register_clock(const clockid_t clock_id,
|
||||||
|
@ -728,16 +733,17 @@ common_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting)
|
||||||
{
|
{
|
||||||
ktime_t now, remaining, iv;
|
ktime_t now, remaining, iv;
|
||||||
struct hrtimer *timer = &timr->it.real.timer;
|
struct hrtimer *timer = &timr->it.real.timer;
|
||||||
|
bool sig_none;
|
||||||
|
|
||||||
memset(cur_setting, 0, sizeof(struct itimerspec));
|
memset(cur_setting, 0, sizeof(struct itimerspec));
|
||||||
|
|
||||||
|
sig_none = timr->it_sigev_notify == SIGEV_NONE;
|
||||||
iv = timr->it.real.interval;
|
iv = timr->it.real.interval;
|
||||||
|
|
||||||
/* interval timer ? */
|
/* interval timer ? */
|
||||||
if (iv.tv64)
|
if (iv.tv64)
|
||||||
cur_setting->it_interval = ktime_to_timespec(iv);
|
cur_setting->it_interval = ktime_to_timespec(iv);
|
||||||
else if (!hrtimer_active(timer) &&
|
else if (!hrtimer_active(timer) && !sig_none)
|
||||||
(timr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE)
|
|
||||||
return;
|
return;
|
||||||
|
|
||||||
now = timer->base->get_time();
|
now = timer->base->get_time();
|
||||||
|
@ -747,8 +753,7 @@ common_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting)
|
||||||
* timer move the expiry time forward by intervals, so
|
* timer move the expiry time forward by intervals, so
|
||||||
* expiry is > now.
|
* expiry is > now.
|
||||||
*/
|
*/
|
||||||
if (iv.tv64 && (timr->it_requeue_pending & REQUEUE_PENDING ||
|
if (iv.tv64 && (timr->it_requeue_pending & REQUEUE_PENDING || sig_none))
|
||||||
(timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE))
|
|
||||||
timr->it_overrun += (unsigned int) hrtimer_forward(timer, now, iv);
|
timr->it_overrun += (unsigned int) hrtimer_forward(timer, now, iv);
|
||||||
|
|
||||||
remaining = ktime_sub(hrtimer_get_expires(timer), now);
|
remaining = ktime_sub(hrtimer_get_expires(timer), now);
|
||||||
|
@ -758,7 +763,7 @@ common_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting)
|
||||||
* A single shot SIGEV_NONE timer must return 0, when
|
* A single shot SIGEV_NONE timer must return 0, when
|
||||||
* it is expired !
|
* it is expired !
|
||||||
*/
|
*/
|
||||||
if ((timr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE)
|
if (!sig_none)
|
||||||
cur_setting->it_value.tv_nsec = 1;
|
cur_setting->it_value.tv_nsec = 1;
|
||||||
} else
|
} else
|
||||||
cur_setting->it_value = ktime_to_timespec(remaining);
|
cur_setting->it_value = ktime_to_timespec(remaining);
|
||||||
|
@ -856,7 +861,7 @@ common_timer_set(struct k_itimer *timr, int flags,
|
||||||
timr->it.real.interval = timespec_to_ktime(new_setting->it_interval);
|
timr->it.real.interval = timespec_to_ktime(new_setting->it_interval);
|
||||||
|
|
||||||
/* SIGEV_NONE timers are not queued ! See common_timer_get */
|
/* SIGEV_NONE timers are not queued ! See common_timer_get */
|
||||||
if (((timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE)) {
|
if (timr->it_sigev_notify == SIGEV_NONE) {
|
||||||
/* Setup correct expiry time for relative timers */
|
/* Setup correct expiry time for relative timers */
|
||||||
if (mode == HRTIMER_MODE_REL) {
|
if (mode == HRTIMER_MODE_REL) {
|
||||||
hrtimer_add_expires(timer, timer->base->get_time());
|
hrtimer_add_expires(timer, timer->base->get_time());
|
||||||
|
|
Loading…
Reference in New Issue