Re: [RFC PATCH 1/2] tty: mediate TIOCSIG through task_kill LSM hooks
From: sashiko-bot@kernel.org
Date: 2026-09-13 22:37:16
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Passing SEND_SIG_PRIV (1) directly to the task_kill LSM hook causes a kernel panic when dereferenced by an eBPF LSM program. -- commit 0444b1560acb73813cdf2e4fa3082c4f0aaf7e00 Author: Christopher Lusk [off-list ref] tty: mediate TIOCSIG through task_kill LSM hooks This commit changes the pty_signal() function to invoke the task_kill LSM hook before delivering signals to the process group. It introduces kill_pgrp_lsm() and __kill_pgrp_info_filtered() to perform this check while holding tasklist_lock. Link: https://lore.kernel.org/r/56bffc24f3d0d08b45a686a48e99766b0a0821fa.1780614610.git.hexlabsecurity@proton.me (local)
quoted hunk ↗ jump to hunk
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c index cc7f7091ed9a2..8f5eea156ce4c 100644 --- a/drivers/tty/pty.c +++ b/drivers/tty/pty.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -195,10 +196,13 @@ static int pty_signal(struct tty_struct *tty, int sig) if (tty->link) { pgrp = tty_get_pgrp(tty->link); if (pgrp) - kill_pgrp(pgrp, sig, 1); + ret = kill_pgrp_lsm(pgrp, sig, 1); put_pid(pgrp); }
[ ... ]
quoted hunk ↗ jump to hunk
diff --git a/kernel/signal.c b/kernel/signal.c index a5e15bf09d319..758393b7257d6 100644 --- a/kernel/signal.c +++ b/kernel/signal.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -1426,13 +1426,22 @@ int group_send_sig_info(int sig, struct kernel_siginfo *info,
[ ... ]
+static int __kill_pgrp_info_filtered(int sig, struct kernel_siginfo *info,
+ struct pid *pgrp, bool check_lsm)
{
struct task_struct *p = NULL;
int ret = -ESRCH;
do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
- int err = group_send_sig_info(sig, info, p, PIDTYPE_PGID);
+ int err = 0;
+
+ if (check_lsm) {
+ rcu_read_lock();
+ err = security_task_kill(p, info, sig, NULL);[Severity: High] Does this pass SEND_SIG_PRIV ((void *)1) directly to the task_kill LSM hook? pty_signal() initiates this by calling kill_pgrp_lsm() with priv=1, which translates to SEND_SIG_PRIV via __si_special(priv). This invalid pointer is then passed directly as the `info` argument to security_task_kill(). When an eBPF LSM program is attached to bpf_lsm_task_kill, it receives `info` as a PTR_TO_BTF_ID | PTR_TRUSTED pointer. The PTR_TRUSTED flag disables BPF's PROBE_MEM fault protection, as the pointer is assumed safe to dereference. If the eBPF program attempts to read info->si_signo, it will execute a normal kernel memory load from address 0x1, causing an immediate kernel panic. Before this patch, check_kill_permission() filtered out SEND_SIG_PRIV via si_fromuser(), preventing it from ever reaching the LSM hook.
+ rcu_read_unlock(); + } + if (!err) + err = group_send_sig_info(sig, info, p, PIDTYPE_PGID);
[ ... ]
quoted hunk ↗ jump to hunk
@@ -1886,6 +1900,18 @@ int kill_pgrp(struct pid *pid, int sig, int priv) } EXPORT_SYMBOL(kill_pgrp); +int kill_pgrp_lsm(struct pid *pid, int sig, int priv) +{ + int ret; + + read_lock(&tasklist_lock); + ret = __kill_pgrp_info_filtered(sig, __si_special(priv), pid, true); + read_unlock(&tasklist_lock); + + return ret; +} +EXPORT_SYMBOL_GPL(kill_pgrp_lsm);
-- Sashiko AI review · https://sashiko.dev/#/patchset/20260913221958.839429-1-clusk@northecho.dev?part=1