Thomas Gleixner cef31d9af9 posix-timer: Properly check sigevent->sigev_notify ... timer_create() specifies via sigevent->sigev_notify the signal delivery for the new timer. The valid modes are SIGEV_NONE, SIGEV_SIGNAL, SIGEV_THREAD and (SIGEV_SIGNAL | SIGEV_THREAD_ID). The sanity check in good_sigevent() is only checking the valid combination for the SIGEV_THREAD_ID bit, i.e. SIGEV_SIGNAL, but if SIGEV_THREAD_ID is not set it accepts any random value. This has no real effects on the posix timer and signal delivery code, but it affects show_timer() which handles the output of /proc/$PID/timers. That function uses a string array to pretty print sigev_notify. The access to that array has no bound checks, so random sigev_notify cause access beyond the array bounds. Add proper checks for the valid notify modes and remove the SIGEV_THREAD_ID masking from various code pathes as SIGEV_NONE can never be set in combination with SIGEV_THREAD_ID. Reported-by: Eric Biggers <ebiggers3@gmail.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Reported-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: John Stultz <john.stultz@linaro.org> Cc: stable@vger.kernel.org		2017-12-15 11:08:40 +01:00
..
alarmtimer.c
clockevents.c
clocksource.c
hrtimer.c
itimer.c
jiffies.c
Kconfig
Makefile
ntp_internal.h
ntp.c
posix-clock.c
posix-cpu-timers.c
posix-stubs.c
posix-timers.c	posix-timer: Properly check sigevent->sigev_notify	2017-12-15 11:08:40 +01:00
posix-timers.h
sched_clock.c
test_udelay.c
tick-broadcast-hrtimer.c
tick-broadcast.c
tick-common.c
tick-internal.h
tick-oneshot.c
tick-sched.c
tick-sched.h
time.c
timeconst.bc
timeconv.c
timecounter.c
timekeeping_debug.c
timekeeping_internal.h
timekeeping.c
timekeeping.h
timer_list.c
timer.c	timer: Pass function down to initialization routines	2017-11-21 15:57:14 -08:00