Thomas Gleixner 77f56f5d39 posix-timer: Properly check sigevent->sigev_notify ... commit cef31d9af9 upstream. timer_create() specifies via sigevent->sigev_notify the signal delivery for the new timer. The valid modes are SIGEV_NONE, SIGEV_SIGNAL, SIGEV_THREAD and (SIGEV_SIGNAL | SIGEV_THREAD_ID). The sanity check in good_sigevent() is only checking the valid combination for the SIGEV_THREAD_ID bit, i.e. SIGEV_SIGNAL, but if SIGEV_THREAD_ID is not set it accepts any random value. This has no real effects on the posix timer and signal delivery code, but it affects show_timer() which handles the output of /proc/$PID/timers. That function uses a string array to pretty print sigev_notify. The access to that array has no bound checks, so random sigev_notify cause access beyond the array bounds. Add proper checks for the valid notify modes and remove the SIGEV_THREAD_ID masking from various code pathes as SIGEV_NONE can never be set in combination with SIGEV_THREAD_ID. Reported-by: Eric Biggers <ebiggers3@gmail.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Reported-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-02-16 20:09:40 +01:00
..
alarmtimer.c	alarmtimer: don't rate limit one-shot timers	2017-07-27 15:06:10 -07:00
clockevents.c
clocksource.c	clocksource: Allow unregistering the watchdog	2016-09-15 08:27:47 +02:00
hrtimer.c	hrtimer: Reset hrtimer cpu base proper on CPU hotplug	2018-01-31 12:06:12 +01:00
itimer.c
jiffies.c
Kconfig
Makefile
ntp_internal.h
ntp.c	ntp: Fix ADJ_SETOFFSET being used w/ ADJ_NANO	2016-09-15 08:27:47 +02:00
posix-clock.c
posix-cpu-timers.c
posix-timers.c	posix-timer: Properly check sigevent->sigev_notify	2018-02-16 20:09:40 +01:00
sched_clock.c
test_udelay.c
tick-broadcast-hrtimer.c
tick-broadcast.c	tick/broadcast: Prevent NULL pointer dereference	2017-01-12 11:22:51 +01:00
tick-common.c
tick-internal.h
tick-oneshot.c
tick-sched.c	nohz: Prevent a timer interrupt storm in tick_nohz_stop_sched_tick()	2018-01-02 20:33:28 +01:00
tick-sched.h
time.c
timeconst.bc
timeconv.c
timecounter.c
timekeeping_debug.c	timekeeping: Cap array access in timekeeping_debug	2016-09-15 08:27:52 +02:00
timekeeping_internal.h
timekeeping.c	time: Fix clock->read(clock) race around clocksource changes	2017-06-29 12:48:51 +02:00
timekeeping.h
timer_list.c
timer_stats.c
timer.c	timers: Plug locking race vs. timer migration	2018-01-31 12:06:08 +01:00