Skip to contentSkip to conversation

Linux 5.15.213

DISCUSSION Greg Kroah-Hartman 1 participant 2 messages Jul 30 Stable branch

lore
Share & tools
lore

Greg Kroah-Hartman

author maintainer
#0 lore raw

I'm announcing the release of the 5.15.213 kernel.

All users of the 5.15 kernel series must upgrade.

The updated 5.15.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                       |    2 
 kernel/exit.c                  |    8 +
 kernel/signal.c                |   10 +
 kernel/time/posix-cpu-timers.c |  212 ++++++++++++++++++++++++-----------------
 4 files changed, 144 insertions(+), 88 deletions(-)

Greg Kroah-Hartman (1):

      Linux 5.15.213

Thomas Gleixner (1):
posix-cpu-timers: Prevent UAF caused by non-leader exec() race

author maintainer
#1 lore raw
Makefile +1 -1
index 35b1f66d7218..783acda54d74 100644
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 15
-SUBLEVEL = 212
+SUBLEVEL = 213
 EXTRAVERSION =
 NAME = Trick or Treat
kernel/exit.c +7 -1
index 3c6ddf7320fa..776994c28887 100644
@@ -200,7 +200,13 @@ static void __exit_signal(struct task_struct *tsk)
 	 * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals.
 	 */
 	flush_sigqueue(&tsk->pending);
-	tsk->sighand = NULL;
+
+	/*
+	 * Ensure that all preceeding state is visible. Pairs with
+	 * the smp_acquire__after_ctrl_dep() in the sighand == NULL
+	 * path of lock_task_sighand().
+	 */
+	smp_store_release(&tsk->sighand, NULL);
 	spin_unlock(&sighand->siglock);
 
 	__cleanup_sighand(sighand);
kernel/signal.c +9 -1
index 10a315e461d3..662377d23c95 100644
@@ -1388,8 +1388,16 @@ struct sighand_struct *__lock_task_sighand(struct task_struct *tsk,
 	rcu_read_lock();
 	for (;;) {
 		sighand = rcu_dereference(tsk->sighand);
-		if (unlikely(sighand == NULL))
+		if (unlikely(sighand == NULL)) {
+			/*
+			 * Pairs with the smp_store_release() in
+			 * __exit_signal().  It ensures that all state
+			 * modifications to the task preceeding the store are
+			 * visible to the callers of lock_task_sighand().
+			 */
+			smp_acquire__after_ctrl_dep();
 			break;
+		}
 
 		/*
 		 * This sighand can be already freed and even reused, but
kernel/time/posix-cpu-timers.c +127 -85

299 lines not on this page · raw message