Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
In-Reply-To: <87k1orgdoo.fsf_-_@xmission.com>
References: <87efft5ncd.fsf_-_@xmission.com> <20180724032419.20231-7-ebiederm@xmission.com>
 <87k1orgdoo.fsf_-_@xmission.com>
From:   Dmitry Vyukov <dvyukov@google.com>
Date:   Fri, 17 Aug 2018 10:34:12 -0700
Message-ID: <CACT4Y+bYFatW=CMgH4M6AjtjO297gbQ8xwnEV0_f7J64FLQ4QQ@mail.gmail.com>
Subject: Re: [PATCH] signal: Don't send signals to tasks that don't exist
To:     "Eric W. Biederman" <ebiederm@xmission.com>
Cc:     Linus Torvalds <torvalds@linux-foundation.org>,
        Oleg Nesterov <oleg@redhat.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Wen Yang <wen.yang99@zte.com.cn>,
        majiang <ma.jiang@zte.com.cn>,
        "J. Bruce Fields" <bfields@fieldses.org>,
        syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
        syzbot <syzbot+1f371ca19b341a276761@syzkaller.appspotmail.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Wed, Aug 15, 2018 at 9:04 PM, Eric W. Biederman
<ebiederm@xmission.com> wrote:
>
> Recently syzbot reported crashes in send_sigio_to_task and
> send_sigurg_to_task in linux-next.  Despite finding a reproducer
> syzbot apparently did not bisected this or otherwise track down the
> offending commit in linux-next.
>
> I happened to see this report and examined the code because I had
> recently changed these functions as part of making PIDTYPE_TGID a real
> pid type so that fork would does not need to restart when receiving a
> signal.  By examination I see that I spotted a bug in the code
> that could explain the reported crashes.
>
> When I took Oleg's suggestion and optimized send_sigurg and send_sigio
> to only send to a single task when type is PIDTYPE_PID or PIDTYPE_TGID
> I failed to handle pids that no longer point to tasks.  The macro
> do_each_pid_task simply iterates for zero iterations.  With pid_task
> an explicit NULL test is needed.
>
> Update the code to include the missing NULL test.
>
> Fixes: 019191342fec ("signal: Use PIDTYPE_TGID to clearly store where file signals will be sent")
> Reported-by: syzkaller-bugs@googlegroups.com

Since the commit does not contain the syzbot-provided Reported-by tag,
we need to tell syzbot that this is fixed explicitly:

#syz fix: signal: Don't send signals to tasks that don't exist

> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
> ---
>  fs/fcntl.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/fs/fcntl.c b/fs/fcntl.c
> index a04accf6847f..4137d96534a6 100644
> --- a/fs/fcntl.c
> +++ b/fs/fcntl.c
> @@ -791,7 +791,8 @@ void send_sigio(struct fown_struct *fown, int fd, int band)
>         if (type <= PIDTYPE_TGID) {
>                 rcu_read_lock();
>                 p = pid_task(pid, PIDTYPE_PID);
> -               send_sigio_to_task(p, fown, fd, band, type);
> +               if (p)
> +                       send_sigio_to_task(p, fown, fd, band, type);
>                 rcu_read_unlock();
>         } else {
>                 read_lock(&tasklist_lock);
> @@ -830,7 +831,8 @@ int send_sigurg(struct fown_struct *fown)
>         if (type <= PIDTYPE_TGID) {
>                 rcu_read_lock();
>                 p = pid_task(pid, PIDTYPE_PID);
> -               send_sigurg_to_task(p, fown, type);
> +               if (p)
> +                       send_sigurg_to_task(p, fown, type);
>                 rcu_read_unlock();
>         } else {
>                 read_lock(&tasklist_lock);
> --
> 2.17.1
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/87k1orgdoo.fsf_-_%40xmission.com.
> For more options, visit https://groups.google.com/d/optout.