Previously, higher 32 bits of exit_signal fields were lost when copied to the kernel args structure (that uses int as a type for the respective field). Moreover, as Oleg has noted[1], exit_signal is used unchecked, so it has to be checked for sanity before use; for the legacy syscalls, applying CSIGNAL mask guarantees that it is at least non-negative; however, there's no such thing is done in clone3() code path, and that can break at least thread_group_leader.
Adding checks that user-passed exit_signal fits into int and passes valid_signal() check solves both of these problems. [1] https://lkml.org/lkml/2019/9/10/467 * kernel/fork.c (copy_clone_args_from_user): Fail with -EINVAL if args.exit_signal is greater than UINT_MAX or is not a valid signal. (_do_fork): Note that exit_signal is expected to be checked for the sanity by the caller. Fixes: 7f192e3cd316 ("fork: add clone3") Reported-by: Oleg Nesterov <o...@redhat.com> Co-authored-by: Oleg Nesterov <o...@redhat.com> Co-authored-by: Dmitry V. Levin <l...@altlinux.org> Signed-off-by: Eugene Syromiatnikov <e...@redhat.com> --- kernel/fork.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/kernel/fork.c b/kernel/fork.c index 2852d0e..f98314b 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2338,6 +2338,8 @@ struct mm_struct *copy_init_mm(void) * * It copies the process, and if successful kick-starts * it and waits for it to finish using the VM if required. + * + * args->exit_signal is expected to be checked for sanity by the caller. */ long _do_fork(struct kernel_clone_args *args) { @@ -2562,6 +2564,15 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs, if (copy_from_user(&args, uargs, size)) return -EFAULT; + /* + * Two separate checks are needed, as valid_signal() takes unsigned long + * as an argument, and struct kernel_clone_args uses int type + * for the exit_signal field. + */ + if (unlikely((args.exit_signal > UINT_MAX) || + !valid_signal(args.exit_signal))) + return -EINVAL; + *kargs = (struct kernel_clone_args){ .flags = args.flags, .pidfd = u64_to_user_ptr(args.pidfd), -- 2.1.4
