From 9b836cd566815ab6302cfe56a7e432376e119652 Mon Sep 17 00:00:00 2001 From: Bradley Morgan Date: Thu, 6 Aug 2026 13:30:13 +0000 Subject: [PATCH] signal: factor out the kernel reserved si_code check The check that prevents userspace from sending siginfo with si_code values reserved to the kernel is duplicated across do_rt_sigqueueinfo(), do_rt_tgsigqueueinfo() and do_pidfd_send_signal(). Move the check into a helper so the rule lives in one place. Link: https://lore.kernel.org/20260806133013.4341-1-include@grrlz.net Signed-off-by: Bradley Morgan Reviewed-by: Andrew Morton Acked-by: Oleg Nesterov Cc: Christian Brauner Cc: Thomas Gleixner Signed-off-by: Andrew Morton --- kernel/signal.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/kernel/signal.c b/kernel/signal.c index fdee0b012a11..a5e15bf09d31 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -3944,6 +3944,15 @@ static void prepare_kill_siginfo(int sig, struct kernel_siginfo *info, info->si_uid = from_kuid_munged(current_user_ns(), current_uid()); } +/* + * Not even root can pretend to send SI_FROMKERNEL() signals. + * Nor can they impersonate kill()/tgkill(), which have si_pid/uid + */ +static bool si_code_reserved_to_kernel(int si_code) +{ + return si_code >= 0 || si_code == SI_TKILL; +} + /** * sys_kill - send a signal to a process * @pid: the PID of the process @@ -4035,7 +4044,7 @@ static int do_pidfd_send_signal(struct pid *pid, int sig, enum pid_type type, /* Only allow sending arbitrary signals to yourself. */ if ((task_pid(current) != pid || type > PIDTYPE_TGID) && - (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL)) + si_code_reserved_to_kernel(kinfo.si_code)) return -EPERM; } else { prepare_kill_siginfo(sig, &kinfo, type); @@ -4190,11 +4199,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int, sig) static int do_rt_sigqueueinfo(pid_t pid, int sig, kernel_siginfo_t *info) { - /* Not even root can pretend to send signals from the kernel. - * Nor can they impersonate a kill()/tgkill(), which adds source info. - */ - if ((info->si_code >= 0 || info->si_code == SI_TKILL) && - (task_pid_vnr(current) != pid)) + if (si_code_reserved_to_kernel(info->si_code) && + task_pid_vnr(current) != pid) return -EPERM; /* POSIX.1b doesn't mention process groups. */ @@ -4237,11 +4243,8 @@ static int do_rt_tgsigqueueinfo(pid_t tgid, pid_t pid, int sig, kernel_siginfo_t if (pid <= 0 || tgid <= 0) return -EINVAL; - /* Not even root can pretend to send signals from the kernel. - * Nor can they impersonate a kill()/tgkill(), which adds source info. - */ - if ((info->si_code >= 0 || info->si_code == SI_TKILL) && - (task_pid_vnr(current) != pid)) + if (si_code_reserved_to_kernel(info->si_code) && + task_pid_vnr(current) != pid) return -EPERM; return do_send_specific(tgid, pid, sig, info);