Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760061AbZFPXLb (ORCPT ); Tue, 16 Jun 2009 19:11:31 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1761580AbZFPXLV (ORCPT ); Tue, 16 Jun 2009 19:11:21 -0400 Received: from mx2.redhat.com ([66.187.237.31]:47957 "EHLO mx2.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1763333AbZFPXLU (ORCPT ); Tue, 16 Jun 2009 19:11:20 -0400 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <20090616222710.GA7620@redhat.com> References: <20090616222710.GA7620@redhat.com> <4A36532E.3050006@redhat.com> <20090615174544.GA10467@redhat.com> <4A36E555.80206@redhat.com> <20090616183829.GA10027@redhat.com> <20090616204941.GB28663@redhat.com> <20090616215103.GA4853@redhat.com> To: Oleg Nesterov Cc: dhowells@redhat.com, Linus Torvalds , Eugene Teo , James Morris , Roland McGrath , solar@openwall.com, linux-kernel@vger.kernel.org Subject: Re: [PATCH] send_sigio_to_task: sanitize the usage of fown->signum Date: Wed, 17 Jun 2009 00:10:24 +0100 Message-ID: <10534.1245193824@redhat.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 682 Lines: 17 Oleg Nesterov wrote: > send_sigio_to_task() reads fown->signum several times, we can race with > F_SETSIG which changes ->signum lockless. In theory, this can fool security > checks or we can call group_send_sig_info() with the wrong ->si_signo which > does not match "int sig". > > Change the code to cache ->signum. > > Signed-off-by: Oleg Nesterov Acked-by: David Howells -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/