[RFC PATCH 2/2] fcntl: recheck signal permissions before falling back to SIGIO

[Shi Lecun]

F_SETSIG allows a file owner to request a signal other than SIGIO.
send_sigio_to_task() checks permission for the configured signal, but
if queuing fails, it falls back to SIGIO without checking permission
for the fallback. Permission for the configured signal does not imply
permission for SIGIO.

Recheck permission before falling back from a different signal to
SIGIO. Keep the existing behavior when SIGIO itself has already been
checked.

This was reproduced on x86-64 QEMU/KVM with AppArmor file signal
mediation added: a recipient allowed a real-time signal but denied
SIGIO reception and set RLIMIT_SIGPENDING to zero. Queuing the
real-time signal failed, and the denied SIGIO was delivered. With this
change, the fallback SIGIO is blocked; allowing SIGIO still permits
fallback.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Shi Lecun <shilc2025@xxxxxxxxxxxxxxxxxxx>
---
 fs/fcntl.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/fcntl.c b/fs/fcntl.c
index 9b71bc9d71d1..5b0c912264ca 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -904,6 +904,9 @@ static void send_sigio_to_task(struct task_struct *p,
 			si.si_fd    = fd;
 			if (!do_send_sig_info(signum, &si, p, type))
 				break;
+			/* The fallback signal may have different permissions. */
+			if (signum != SIGIO && !sigio_perm(p, fown, SIGIO))
+				break;
 		}
 			fallthrough;	/* fall back on the old plain SIGIO signal */
 		case 0:
-- 
2.56.0