Re: [PATCH -mm v2] do_notify_parent: sanitize the valid_signal() checks

[Andrew Morton]

On Sun, 17 May 2026 09:05:26 +0200 Oleg Nesterov <oleg@xxxxxxxxxx> wrote:

> On 05/17, Tetsuo Handa wrote:
> >
> > On 2026/03/18 4:08, Oleg Nesterov wrote:
> > > On 03/17, Andrew Morton wrote:
> > >>
> > >> On Tue, 17 Mar 2026 14:58:18 +0100 Oleg Nesterov <oleg@xxxxxxxxxx> wrote:
> > >>
> > >>> Now that kernel_clone() checks valid_signal(args->exit_signal), the "sig"
> > >>> argument of do_notify_parent() must always be valid or we have a bug.
> >
> > No activity for two months. When is the fix expected to land to upstream?
> > This bug allows a local unprivileged user to crash panic_on_warn=1 systems
> > by running below program, and therefore should be fixed before Linux 7.1 is
> > released.
> 
> This patch depends on
> 
> 	[PATCH v3] kernel/fork: validate exit_signal in kernel_clone()
> 	https://lore.kernel.org/all/20260316151956.563558-1-kartikey406@xxxxxxxxx/
> 
> but it was merged without the patch above.
> 
> Andrew, that patch is still in mm tree,
> 
> 	kernel-fork-validate-exit_signal-in-kernel_clone.patch
> 
> could you merge it as well?

Thanks, I moved the below out of the 7.2-rc1 queue and into the 7.1-rcX
queue.

Should this have cc:stable?


From: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
Subject: kernel/fork: validate exit_signal in kernel_clone()
Date: Mon, 16 Mar 2026 20:49:56 +0530

When a child process exits, it sends exit_signal to its parent via
do_notify_parent().  The clone() syscall constructs exit_signal as:

(lower_32_bits(clone_flags) & CSIGNAL)

CSIGNAL is 0xff, so values in the range 65-255 are possible.  However,
valid_signal() only accepts signals up to _NSIG (64 on x86_64).  A
non-zero non-valid exit_signal acts the same as exit_signal == 0: the
parent process is not signaled when the child terminates.

The syzkaller reproducer triggers this by calling clone() with flags=0x80,
resulting in exit_signal = (0x80 & CSIGNAL) = 128, which exceeds _NSIG and
is not a valid signal.

The v1 of this patch added the check only in the clone() syscall handler,
which is incomplete.  kernel_clone() has other callers such as
sys_ia32_clone() which would remain unprotected.  Move the check to
kernel_clone() to cover all callers.

Since the valid_signal() check is now in kernel_clone() and covers all
callers including clone3(), the same check in copy_clone_args_from_user()
becomes redundant and is removed.  The higher 32bits check for clone3() is
kept as it is clone3() specific.

Note that this is a user-visible change: previously, passing an invalid
exit_signal to clone() was silently accepted.  The man page for clone()
does not document any defined behavior for invalid exit_signal values, so
rejecting them with -EINVAL is the correct behavior.  It is unlikely that
any sane application relies on passing an invalid exit_signal.

[oleg@xxxxxxxxxx: the comment above kernel_clone() should be updated]
  Link: https://lore.kernel.org/abwvgU17W8wuW2-J@xxxxxxxxxx
Link: https://lore.kernel.org/20260316151956.563558-1-kartikey406@xxxxxxxxx
Fixes: 3f2c788a1314 ("fork: prevent accidental access to clone3 features")
Signed-off-by: Deepanshu Kartikey <Kartikey406@xxxxxxxxx>
Signed-off-by: Oleg Nesterov <oleg@xxxxxxxxxx>
Reported-by: syzbot+bbe6b99feefc3a0842de@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=bbe6b99feefc3a0842de
Tested-by: syzbot+bbe6b99feefc3a0842de@xxxxxxxxxxxxxxxxxxxxxxxxx
Link: https://lore.kernel.org/all/20260307064202.353405-1-kartikey406@xxxxxxxxx/T/ [v1]
Link: https://lore.kernel.org/all/20260316104536.558108-1-kartikey406@xxxxxxxxx/T/ [v2]
Acked-by: Oleg Nesterov <oleg@xxxxxxxxxx>
Acked-by: Michal Hocko <mhocko@xxxxxxxx>
Cc: Ben Segall <bsegall@xxxxxxxxxx>
Cc: Christian Brauner <brauner@xxxxxxxxxx>
Cc: David Hildenbrand <david@xxxxxxxxxx>
Cc: Dietmar Eggemann <dietmar.eggemann@xxxxxxx>
Cc: Ingo Molnar <mingo@xxxxxxxxxx>
Cc: Juri Lelli <juri.lelli@xxxxxxxxxx>
Cc: Kees Cook <kees@xxxxxxxxxx>
Cc: Liam Howlett <liam@xxxxxxxxxxxxx>
Cc: Lorenzo Stoakes (Oracle) <ljs@xxxxxxxxxx>
Cc: Mel Gorman <mgorman@xxxxxxx>
Cc: Mike Rapoport <rppt@xxxxxxxxxx>
Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
Cc: Steven Rostedt <rostedt@xxxxxxxxxxx>
Cc: Suren Baghdasaryan <surenb@xxxxxxxxxx>
Cc: Valentin Schneider <vschneid@xxxxxxxxxx>
Cc: Vincent Guittot <vincent.guittot@xxxxxxxxxx>
Cc: Vlastimil Babka <vbabka@xxxxxxxxxx>
Cc: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---

 kernel/fork.c |   11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

--- a/kernel/fork.c~kernel-fork-validate-exit_signal-in-kernel_clone
+++ a/kernel/fork.c
@@ -2664,8 +2664,6 @@ struct task_struct *create_io_thread(int
  *
  * It copies the process, and if successful kick-starts
  * it and waits for it to finish using the VM if required.
- *
- * args->exit_signal is expected to be checked for sanity by the caller.
  */
 pid_t kernel_clone(struct kernel_clone_args *args)
 {
@@ -2700,6 +2698,9 @@ pid_t kernel_clone(struct kernel_clone_a
 	    (args->pidfd == args->parent_tid))
 		return -EINVAL;
 
+	if (!valid_signal(args->exit_signal))
+		return -EINVAL;
+
 	/*
 	 * Determine whether and which event to report to ptracer.  When
 	 * called from kernel_thread or CLONE_UNTRACED is explicitly
@@ -2898,11 +2899,9 @@ static noinline int copy_clone_args_from
 		return -EINVAL;
 
 	/*
-	 * Verify that higher 32bits of exit_signal are unset and that
-	 * it is a valid signal
+	 * Verify that higher 32bits of exit_signal are unset
 	 */
-	if (unlikely((args.exit_signal & ~((u64)CSIGNAL)) ||
-		     !valid_signal(args.exit_signal)))
+	if (unlikely(args.exit_signal & ~((u64)CSIGNAL)))
 		return -EINVAL;
 
 	if ((args.flags & CLONE_INTO_CGROUP) &&
_