On Thu, Sep 13, 2018 at 12:48:43PM +0200, Eric W. Biederman wrote:
>
> The genweq_add_file and genwqe_del_file by caching current without
> using reference counting embed the assumption that a file descriptor
> will never be passed from one process to another. It even embeds the
> assumption that the the thread that opened the file will be in
> existence when the process terminates. Neither of which are
> guaranteed to be true.
>
> Therefore replace caching the task_struct of the opener with
> pid of the openers thread group id. All the knowledge of the
> opener is used for is as the target of SIGKILL and a SIGKILL
> will kill the entire process group.
>
> Rename genwqe_force_sig to genwqe_terminate, remove it's unncessary
> signal argument, update it's ownly caller, and use kill_pid
> instead of force_sig.
>
> The work force_sig does in changing signal handling state is not
> relevant to SIGKILL sent as SEND_SIG_PRIV. The exact same processess
> will be killed just with less work, and less confusion. The work done
> by force_sig is really only needed for handling syncrhonous
> exceptions.
>
> It will still be possible to cause genwqe_device_remove to wait 8
> seconds by passing a file descriptor to another process but the possible
> user after free is fixed.
>
> Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
> Cc: [email protected]
> Cc: Greg Kroah-Hartman <[email protected]>
> Cc: Frank Haverkamp <[email protected]>
> Cc: Joerg-Stephan Vogt <[email protected]>
> Cc: Michael Jung <[email protected]>
> Cc: Michael Ruettger <[email protected]>
> Cc: Kleber Sacilotto de Souza <[email protected]>
> Cc: Sebastian Ott <[email protected]>
> Cc: Eberhard S. Amann <[email protected]>
> Cc: Gabriel Krisman Bertazi <[email protected]>
> Cc: Guilherme G. Piccoli <[email protected]>
> Signed-off-by: "Eric W. Biederman" <[email protected]>
> ---
>
> Greg I intend to take this through my signal tree, but if you would
> rather take this through your driver tree please feel free.
No objection from me for you to take it through your tree:
Acked-by: Greg Kroah-Hartman <[email protected]>
