linux/drivers/misc
Eric W. Biederman 0ab93e9c99 signal/GenWQE: Fix sending of SIGKILL
The genweq_add_file and genwqe_del_file by caching current without
using reference counting embed the assumption that a file descriptor
will never be passed from one process to another.  It even embeds the
assumption that the the thread that opened the file will be in
existence when the process terminates.   Neither of which are
guaranteed to be true.

Therefore replace caching the task_struct of the opener with
pid of the openers thread group id.  All the knowledge of the
opener is used for is as the target of SIGKILL and a SIGKILL
will kill the entire process group.

Rename genwqe_force_sig to genwqe_terminate, remove it's unncessary
signal argument, update it's ownly caller, and use kill_pid
instead of force_sig.

The work force_sig does in changing signal handling state is not
relevant to SIGKILL sent as SEND_SIG_PRIV.  The exact same processess
will be killed just with less work, and less confusion.  The work done
by force_sig is really only needed for handling syncrhonous
exceptions.

It will still be possible to cause genwqe_device_remove to wait
8 seconds by passing a file descriptor to another process but
the possible user after free is fixed.

Fixes: eaf4722d46 ("GenWQE Character device and DDCB queue")
Cc: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Frank Haverkamp <haver@linux.vnet.ibm.com>
Cc: Joerg-Stephan Vogt <jsvogt@de.ibm.com>
Cc: Michael Jung <mijung@gmx.net>
Cc: Michael Ruettger <michael@ibmra.de>
Cc: Kleber Sacilotto de Souza <klebers@linux.vnet.ibm.com>
Cc: Sebastian Ott <sebott@linux.vnet.ibm.com>
Cc: Eberhard S. Amann <esa@linux.vnet.ibm.com>
Cc: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Cc: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2018-09-15 16:07:19 +02:00
..
altera-stapl treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
c2port
cardreader misc: rtsx: make several functions static 2018-07-03 13:01:48 +02:00
cb710 cb710: Convert to new IDA API 2018-08-21 23:54:18 -04:00
cxl Merge branch 'akpm' (patches from Andrew) 2018-08-17 16:49:31 -07:00
echo
eeprom Merge branch 'i2c/for-4.19' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2018-08-21 17:40:46 -07:00
genwqe signal/GenWQE: Fix sending of SIGKILL 2018-09-15 16:07:19 +02:00
ibmasm ibmasm: don't write out of bounds in read handler 2018-07-07 09:59:35 +02:00
lis3lv02d
lkdtm
mei mei: define dma ring buffer sizes for PCH12 HW and newer 2018-08-02 10:18:30 +02:00
mic mm, oom: distinguish blockable mode for mmu notifiers 2018-08-22 10:52:44 -07:00
ocxl Merge branch 'akpm' (patches from Andrew) 2018-08-17 16:49:31 -07:00
sgi-gru mm, oom: distinguish blockable mode for mmu notifiers 2018-08-22 10:52:44 -07:00
sgi-xp sgi-xp: xpc_partition: mark expected switch fall-throughs 2018-07-07 17:38:57 +02:00
ti-st misc: ti-st: Fix memory leak in the error path of probe() 2018-08-02 10:35:04 +02:00
vmw_vmci vmci: type promotion bug in qp_host_get_user_memory() 2018-07-07 17:32:40 +02:00
ad525x_dpot-i2c.c
ad525x_dpot-spi.c
ad525x_dpot.c
ad525x_dpot.h
apds990x.c
apds9802als.c
aspeed-lpc-ctrl.c
aspeed-lpc-snoop.c drivers/misc: Aspeed LPC snoop output using misc chardev 2018-07-16 13:30:47 +02:00
atmel_tclib.c
atmel-ssc.c
bh1770glc.c
cs5535-mfgpt.c
ds1682.c
dummy-irq.c
enclosure.c
fsa9480.c
hmc6352.c
hpilo.c
hpilo.h
ibmvmc.c misc: ibmvmc: Use GFP_ATOMIC under spin lock 2018-07-07 17:35:00 +02:00
ibmvmc.h misc: IBM Virtual Management Channel Driver (VMC) 2018-05-14 16:35:42 +02:00
ics932s401.c
ioc4.c
isl29003.c
isl29020.c
Kconfig misc: IBM Virtual Management Channel Driver (VMC) 2018-05-14 16:35:42 +02:00
kgdbts.c
lattice-ecp3-config.c
Makefile misc: IBM Virtual Management Channel Driver (VMC) 2018-05-14 16:35:42 +02:00
pch_phub.c
pci_endpoint_test.c pci_endpoint_test: Add 2 ioctl commands 2018-07-19 11:46:57 +01:00
phantom.c
pti.c
qcom-coincell.c
spear13xx_pcie_gadget.c
sram-exec.c
sram.c misc: sram: enable clock before registering regions 2018-07-06 16:48:15 +02:00
sram.h
tifm_7xx1.c misc: tifm: Remove VLA 2018-04-23 13:31:27 +02:00
tifm_core.c
tsl2550.c tsl2550: fix lux1_input error in low light 2018-07-07 17:44:52 +02:00
vexpress-syscfg.c misc: vexpress/syscfg: Use devm_ioremap_resource() to map memory 2018-07-16 13:32:08 +02:00
vmw_balloon.c Merge 4.18-rc5 into char-misc-next 2018-07-16 09:04:54 +02:00