Skip to contentSkip to conversation

Linux 5.10.262

DISCUSSION Greg Kroah-Hartman 1 participant 2 messages Jul 30 Stable branch

lore
Share & tools
lore

Greg Kroah-Hartman

author maintainer
#0 lore raw

I'm announcing the release of the 5.10.262 kernel.

All users of the 5.10 kernel series must upgrade.

The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                       |    2 
 kernel/exit.c                  |    8 +
 kernel/signal.c                |   10 +-
 kernel/time/posix-cpu-timers.c |  185 ++++++++++++++++++++++++++---------------
 4 files changed, 138 insertions(+), 67 deletions(-)

Greg Kroah-Hartman (1):

      Linux 5.10.262

Thomas Gleixner (1):
posix-cpu-timers: Prevent UAF caused by non-leader exec() race

author maintainer
#1 lore raw
Makefile +1 -1
index 1c3feb44c5ee..47c4cf8165d4 100644
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 261
+SUBLEVEL = 262
 EXTRAVERSION =
 NAME = Dare mighty things
kernel/exit.c +7 -1
index 99ab6d7a09ce..675a0f4c89e1 100644
@@ -200,7 +200,13 @@ static void __exit_signal(struct task_struct *tsk)
 	 * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals.
 	 */
 	flush_sigqueue(&tsk->pending);
-	tsk->sighand = NULL;
+
+	/*
+	 * Ensure that all preceeding state is visible. Pairs with
+	 * the smp_acquire__after_ctrl_dep() in the sighand == NULL
+	 * path of lock_task_sighand().
+	 */
+	smp_store_release(&tsk->sighand, NULL);
 	spin_unlock(&sighand->siglock);
 
 	__cleanup_sighand(sighand);
kernel/signal.c +9 -1
index 463b798651b6..e0fb44e57a31 100644
@@ -1375,8 +1375,16 @@ struct sighand_struct *__lock_task_sighand(struct task_struct *tsk,
 	rcu_read_lock();
 	for (;;) {
 		sighand = rcu_dereference(tsk->sighand);
-		if (unlikely(sighand == NULL))
+		if (unlikely(sighand == NULL)) {
+			/*
+			 * Pairs with the smp_store_release() in
+			 * __exit_signal().  It ensures that all state
+			 * modifications to the task preceeding the store are
+			 * visible to the callers of lock_task_sighand().
+			 */
+			smp_acquire__after_ctrl_dep();
 			break;
+		}
 
 		/*
 		 * This sighand can be already freed and even reused, but
kernel/time/posix-cpu-timers.c +121 -64

270 lines not on this page · raw message