1 files changed, 36 insertions, 30 deletions

diff --git a/kernel/signal.c b/kernel/signal.c
index 6b982f2cf524..934ae5e687b9 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -218,13 +218,13 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi
         struct user_struct *user;
 
         /*
-         * We won't get problems with the target's UID changing under us
-         * because changing it requires RCU be used, and if t != current, the
-         * caller must be holding the RCU readlock (by way of a spinlock) and
-         * we use RCU protection here
+         * Protect access to @t credentials. This can go away when all
+         * callers hold rcu read lock.
          */
+        rcu_read_lock();
         user = get_uid(__task_cred(t)->user);
         atomic_inc(&user->sigpending);
+        rcu_read_unlock();
 
         if (override_rlimit ||
             atomic_read(&user->sigpending) <=
@@ -423,7 +423,7 @@ still_pending:
                  */
                 info->si_signo = sig;
                 info->si_errno = 0;
-                info->si_code = 0;
+                info->si_code = SI_USER;
                 info->si_pid = 0;
                 info->si_uid = 0;
         }
@@ -607,6 +607,17 @@ static int rm_from_queue(unsigned long mask, struct sigpending *s)
         return 1;
 }
 
+static inline int is_si_special(const struct siginfo *info)
+{
+        return info <= SEND_SIG_FORCED;
+}
+
+static inline bool si_fromuser(const struct siginfo *info)
+{
+        return info == SEND_SIG_NOINFO ||
+                (!is_si_special(info) && SI_FROMUSER(info));
+}
+
 /*
  * Bad permissions for sending the signal
  * - the caller must hold at least the RCU read lock
@@ -621,7 +632,7 @@ static int check_kill_permission(int sig, struct siginfo *info,
         if (!valid_signal(sig))
                 return -EINVAL;
 
-        if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
+        if (!si_fromuser(info))
                 return 0;
 
         error = audit_signal_info(sig, t); /* Let audit system see the signal */
@@ -949,9 +960,8 @@ static int send_signal(int sig, struct siginfo *info, struct task_struct *t,
         int from_ancestor_ns = 0;
 
 #ifdef CONFIG_PID_NS
-        if (!is_si_special(info) && SI_FROMUSER(info) &&
-                        task_pid_nr_ns(current, task_active_pid_ns(t)) <= 0)
-                from_ancestor_ns = 1;
+        from_ancestor_ns = si_fromuser(info) &&
+                           !task_pid_nr_ns(current, task_active_pid_ns(t));
 #endif
 
         return __send_signal(sig, info, t, group, from_ancestor_ns);
@@ -969,7 +979,8 @@ static void print_fatal_signal(struct pt_regs *regs, int signr)
                 for (i = 0; i < 16; i++) {
                         unsigned char insn;
 
-                        __get_user(insn, (unsigned char *)(regs->ip + i));
+                        if (get_user(insn, (unsigned char *)(regs->ip + i)))
+                                break;
                         printk("%02x ", insn);
                 }
         }
@@ -1052,12 +1063,6 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
         return ret;
 }
 
-void
-force_sig_specific(int sig, struct task_struct *t)
-{
-        force_sig_info(sig, SEND_SIG_FORCED, t);
-}
-
 /*
  * Nuke all other threads in the group.
  */
@@ -1175,19 +1180,19 @@ int kill_pid_info_as_uid(int sig, struct siginfo *info, struct pid *pid,
         int ret = -EINVAL;
         struct task_struct *p;
         const struct cred *pcred;
+        unsigned long flags;
 
         if (!valid_signal(sig))
                 return ret;
 
-        read_lock(&tasklist_lock);
+        rcu_read_lock();
         p = pid_task(pid, PIDTYPE_PID);
         if (!p) {
                 ret = -ESRCH;
                 goto out_unlock;
         }
         pcred = __task_cred(p);
-        if ((info == SEND_SIG_NOINFO ||
-             (!is_si_special(info) && SI_FROMUSER(info))) &&
+        if (si_fromuser(info) &&
             euid != pcred->suid && euid != pcred->uid &&
             uid  != pcred->suid && uid  != pcred->uid) {
                 ret = -EPERM;
@@ -1196,14 +1201,16 @@ int kill_pid_info_as_uid(int sig, struct siginfo *info, struct pid *pid,
         ret = security_task_kill(p, info, sig, secid);
         if (ret)
                 goto out_unlock;
-        if (sig && p->sighand) {
-                unsigned long flags;
-                spin_lock_irqsave(&p->sighand->siglock, flags);
-                ret = __send_signal(sig, info, p, 1, 0);
-                spin_unlock_irqrestore(&p->sighand->siglock, flags);
+
+        if (sig) {
+                if (lock_task_sighand(p, &flags)) {
+                        ret = __send_signal(sig, info, p, 1, 0);
+                        unlock_task_sighand(p, &flags);
+                } else
+                        ret = -ESRCH;
         }
 out_unlock:
-        read_unlock(&tasklist_lock);
+        rcu_read_unlock();
         return ret;
 }
 EXPORT_SYMBOL_GPL(kill_pid_info_as_uid);
@@ -1837,11 +1844,6 @@ relock:
 
         for (;;) {
                 struct k_sigaction *ka;
-
-                if (unlikely(signal->group_stop_count > 0) &&
-                    do_signal_stop(0))
-                        goto relock;
-
                 /*
                  * Tracing can induce an artifical signal and choose sigaction.
                  * The return value in @signr determines the default action,
@@ -1853,6 +1855,10 @@ relock:
                 if (unlikely(signr != 0))
                         ka = return_ka;
                 else {
+                        if (unlikely(signal->group_stop_count > 0) &&
+                            do_signal_stop(0))
+                                goto relock;
+
                         signr = dequeue_signal(current, &current->blocked,
                                                info);