p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull timer fix from Thomas Gleixner:
 "A single bugfix which prevents arbitrary sigev_notify values in
  posix-timers"

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  posix-timer: Properly check sigevent->sigev_notify
This commit is contained in:
Linus Torvalds 2017-12-17 13:48:50 -08:00
parent c43727908f cef31d9af9
commit 2ffb448ccb
1 changed files with 17 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
kernel/time/posix-timers.c
View File

@ -434,17 +434,22 @@ static struct pid *good_sigevent(sigevent_t * event)
{ {
struct task_struct *rtn = current->group_leader; struct task_struct *rtn = current->group_leader;
if ((event->sigev_notify & SIGEV_THREAD_ID ) && switch (event->sigev_notify) {
(!(rtn = find_task_by_vpid(event->sigev_notify_thread_id)) || case SIGEV_SIGNAL | SIGEV_THREAD_ID:
!same_thread_group(rtn, current) || rtn = find_task_by_vpid(event->sigev_notify_thread_id);
(event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_SIGNAL)) if (!rtn || !same_thread_group(rtn, current))
return NULL; return NULL;
/* FALLTHRU */
if (((event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) && case SIGEV_SIGNAL:
((event->sigev_signo <= 0) || (event->sigev_signo > SIGRTMAX))) case SIGEV_THREAD:
if (event->sigev_signo <= 0 || event->sigev_signo > SIGRTMAX)
return NULL; return NULL;
/* FALLTHRU */
case SIGEV_NONE:
return task_pid(rtn); return task_pid(rtn);
default:
return NULL;
}
} }
static struct k_itimer * alloc_posix_timer(void) static struct k_itimer * alloc_posix_timer(void)
@ -669,7 +674,7 @@ void common_timer_get(struct k_itimer *timr, struct itimerspec64 *cur_setting)
struct timespec64 ts64; struct timespec64 ts64;
bool sig_none; bool sig_none;
sig_none = (timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE; sig_none = timr->it_sigev_notify == SIGEV_NONE;
iv = timr->it_interval; iv = timr->it_interval;
/* interval timer ? */ /* interval timer ? */
@ -856,7 +861,7 @@ int common_timer_set(struct k_itimer *timr, int flags,
timr->it_interval = timespec64_to_ktime(new_setting->it_interval); timr->it_interval = timespec64_to_ktime(new_setting->it_interval);
expires = timespec64_to_ktime(new_setting->it_value); expires = timespec64_to_ktime(new_setting->it_value);
sigev_none = (timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE; sigev_none = timr->it_sigev_notify == SIGEV_NONE;
kc->timer_arm(timr, expires, flags & TIMER_ABSTIME, sigev_none); kc->timer_arm(timr, expires, flags & TIMER_ABSTIME, sigev_none);
timr->it_active = !sigev_none; timr->it_active = !sigev_none;