Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fix from Thomas Gleixner: "A single bugfix which prevents arbitrary sigev_notify values in posix-timers" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: posix-timer: Properly check sigevent->sigev_notify
This commit is contained in:
commit
2ffb448ccb
|
@ -434,17 +434,22 @@ static struct pid *good_sigevent(sigevent_t * event)
|
||||||
{
|
{
|
||||||
struct task_struct *rtn = current->group_leader;
|
struct task_struct *rtn = current->group_leader;
|
||||||
|
|
||||||
if ((event->sigev_notify & SIGEV_THREAD_ID ) &&
|
switch (event->sigev_notify) {
|
||||||
(!(rtn = find_task_by_vpid(event->sigev_notify_thread_id)) ||
|
case SIGEV_SIGNAL | SIGEV_THREAD_ID:
|
||||||
!same_thread_group(rtn, current) ||
|
rtn = find_task_by_vpid(event->sigev_notify_thread_id);
|
||||||
(event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_SIGNAL))
|
if (!rtn || !same_thread_group(rtn, current))
|
||||||
|
return NULL;
|
||||||
|
/* FALLTHRU */
|
||||||
|
case SIGEV_SIGNAL:
|
||||||
|
case SIGEV_THREAD:
|
||||||
|
if (event->sigev_signo <= 0 || event->sigev_signo > SIGRTMAX)
|
||||||
|
return NULL;
|
||||||
|
/* FALLTHRU */
|
||||||
|
case SIGEV_NONE:
|
||||||
|
return task_pid(rtn);
|
||||||
|
default:
|
||||||
return NULL;
|
return NULL;
|
||||||
|
}
|
||||||
if (((event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) &&
|
|
||||||
((event->sigev_signo <= 0) || (event->sigev_signo > SIGRTMAX)))
|
|
||||||
return NULL;
|
|
||||||
|
|
||||||
return task_pid(rtn);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static struct k_itimer * alloc_posix_timer(void)
|
static struct k_itimer * alloc_posix_timer(void)
|
||||||
|
@ -669,7 +674,7 @@ void common_timer_get(struct k_itimer *timr, struct itimerspec64 *cur_setting)
|
||||||
struct timespec64 ts64;
|
struct timespec64 ts64;
|
||||||
bool sig_none;
|
bool sig_none;
|
||||||
|
|
||||||
sig_none = (timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE;
|
sig_none = timr->it_sigev_notify == SIGEV_NONE;
|
||||||
iv = timr->it_interval;
|
iv = timr->it_interval;
|
||||||
|
|
||||||
/* interval timer ? */
|
/* interval timer ? */
|
||||||
|
@ -856,7 +861,7 @@ int common_timer_set(struct k_itimer *timr, int flags,
|
||||||
|
|
||||||
timr->it_interval = timespec64_to_ktime(new_setting->it_interval);
|
timr->it_interval = timespec64_to_ktime(new_setting->it_interval);
|
||||||
expires = timespec64_to_ktime(new_setting->it_value);
|
expires = timespec64_to_ktime(new_setting->it_value);
|
||||||
sigev_none = (timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE;
|
sigev_none = timr->it_sigev_notify == SIGEV_NONE;
|
||||||
|
|
||||||
kc->timer_arm(timr, expires, flags & TIMER_ABSTIME, sigev_none);
|
kc->timer_arm(timr, expires, flags & TIMER_ABSTIME, sigev_none);
|
||||||
timr->it_active = !sigev_none;
|
timr->it_active = !sigev_none;
|
||||||
|
|
Loading…
Reference in New Issue