signal: skip blocked signals in dequeue_synchronous_signal()

dequeue_synchronous_signal() checks whether an unblocked
synchronous signal is pending, but its queue scan can select a
different blocked entry with a positive si_code. This can deliver
a signal while it is still blocked.

Check the blocked mask for each queued entry. Forced faults
are unblocked when necessary by force_sig_info_to_task(), and the
existing pending bookkeeping is unchanged.

Fixes: 7146db3317 ("signal: Better detection of synchronous signals")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
Link: https://patch.msgid.link/20261020181101.1605736-1-thnkslprpt@gmail.com
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Avi Weiss 2026-10-20 21:11:01 +03:00 committed by Christian Brauner
parent 716d2968c8
commit 4bd3a0e8e5
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2

View File

@ -684,12 +684,13 @@ static int dequeue_synchronous_signal(kernel_siginfo_t *info)
return 0;
/*
* Return the first synchronous signal in the queue.
* Return the first unblocked synchronous signal in the queue.
*/
list_for_each_entry(q, &pending->list, list) {
/* Synchronous signals have a positive si_code */
if ((q->info.si_code > SI_USER) &&
(sigmask(q->info.si_signo) & SYNCHRONOUS_MASK)) {
(sigmask(q->info.si_signo) & SYNCHRONOUS_MASK) &&
!sigismember(&tsk->blocked, q->info.si_signo)) {
sync = q;
goto next;
}