Re: + signal-factor-out-the-kernel-reserved-si_c ode-check.patch added to mm-nonmm-unstable branch

On 6 August 2026 19:18:24 BST, Andrew Morton <[email protected]>
wrote:
>
>The patch titled
>     Subject: signal: factor out the kernel reserved si_code check
>has been added to the -mm mm-nonmm-unstable branch.  Its filename is
>     signal-factor-out-the-kernel-reserved-si_code-check.patch
>
>This patch will shortly appear at
>     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/signal-factor-out-the-kernel-reserved-si_code-check.patch
>
>This patch will later appear in the mm-nonmm-unstable branch at
>    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
>
>Before you just go and hit "reply", please:
>   a) Consider who else should be cc'ed
>   b) Prefer to cc a suitable mailing list as well
>   c) Ideally: find the original patch on the mailing list and do a
>      reply-to-all to that, adding suitable additional cc's
>
>*** Remember to use Documentation/process/submit-checklist.rst when
>testing your code ***
>
>The -mm tree is included into linux-next via various
>branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
>and is updated there most days
>
>------------------------------------------------------
>From: Bradley Morgan <[email protected]>
>Subject: signal: factor out the kernel reserved si_code check
>Date: Thu, 6 Aug 2026 13:30:13 +0000
>
>The check that prevents userspace from sending siginfo with si_code values
>reserved to the kernel is duplicated across do_rt_sigqueueinfo(),
>do_rt_tgsigqueueinfo() and do_pidfd_send_signal().  Move the check into a
>helper so the rule lives in one place.
>
>Link: https://lore.kernel.org/[email protected]
>Signed-off-by: Bradley Morgan <[email protected]>
>Reviewed-by: Andrew Morton <[email protected]>

Thanks for the R-B, Oleg added his A-B btw.

>Cc: Christian Brauner <[email protected]>
>Cc: Oleg Nesterov <[email protected]>
>Cc: Thomas Gleixner <[email protected]>
>Signed-off-by: Andrew Morton <[email protected]>
>---
>
> kernel/signal.c |   25 ++++++++++++++-----------
> 1 file changed, 14 insertions(+), 11 deletions(-)
>
>--- a/kernel/signal.c~signal-factor-out-the-kernel-reserved-si_code-check
>+++ a/kernel/signal.c
>@@ -3944,6 +3944,15 @@ static void prepare_kill_siginfo(int sig
> 	info->si_uid = from_kuid_munged(current_user_ns(), current_uid());
> }
> 
>+/*
>+ * Not even root can pretend to send SI_FROMKERNEL() signals.
>+ * Nor can they impersonate kill()/tgkill(), which have si_pid/uid
>+ */
>+static bool si_code_reserved_to_kernel(int si_code)
>+{
>+	return si_code >= 0 || si_code == SI_TKILL;
>+}
>+
> /**
>  *  sys_kill - send a signal to a process
>  *  @pid: the PID of the process
>@@ -4035,7 +4044,7 @@ static int do_pidfd_send_signal(struct p
> 
> 		/* Only allow sending arbitrary signals to yourself. */
> 		if ((task_pid(current) != pid || type > PIDTYPE_TGID) &&
>-		    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL))
>+		    si_code_reserved_to_kernel(kinfo.si_code))
> 			return -EPERM;
> 	} else {
> 		prepare_kill_siginfo(sig, &kinfo, type);
>@@ -4190,11 +4199,8 @@ SYSCALL_DEFINE2(tkill, pid_t, pid, int,
> 
> static int do_rt_sigqueueinfo(pid_t pid, int sig, kernel_siginfo_t *info)
> {
>-	/* Not even root can pretend to send signals from the kernel.
>-	 * Nor can they impersonate a kill()/tgkill(), which adds source info.
>-	 */
>-	if ((info->si_code >= 0 || info->si_code == SI_TKILL) &&
>-	    (task_pid_vnr(current) != pid))
>+	if (si_code_reserved_to_kernel(info->si_code) &&
>+	    task_pid_vnr(current) != pid)
> 		return -EPERM;
> 
> 	/* POSIX.1b doesn't mention process groups.  */
>@@ -4237,11 +4243,8 @@ static int do_rt_tgsigqueueinfo(pid_t tg
> 	if (pid <= 0 || tgid <= 0)
> 		return -EINVAL;
> 
>-	/* Not even root can pretend to send signals from the kernel.
>-	 * Nor can they impersonate a kill()/tgkill(), which adds source info.
>-	 */
>-	if ((info->si_code >= 0 || info->si_code == SI_TKILL) &&
>-	    (task_pid_vnr(current) != pid))
>+	if (si_code_reserved_to_kernel(info->si_code) &&
>+	    task_pid_vnr(current) != pid)
> 		return -EPERM;
> 
> 	return do_send_specific(tgid, pid, sig, info);
>_
>
>Patches currently in -mm which might be from [email protected] are
>
>taskstats-drop-the-dead-null-attribute-check-in-parse.patch
>taskstats-fold-the-two-cpumask-handlers-into-one.patch
>taskstats-copy-signal-stats-under-siglock-in-taskstats_exit.patch
>signal-factor-out-the-kernel-reserved-si_code-check.patch
>
>

Thanks!