Skip to content

Commit 39ff273

Browse files
committed
sighook: Don't forget to reset list->tail on the last sigpop()
This was causing a UAF if we ever unregistered the last hook for a signal and then re-registered one. Fixes: 75b7f70 ("sighook: Make sigunhook() O(1)")
1 parent 7b33959 commit 39ff273

2 files changed

Lines changed: 9 additions & 0 deletions

File tree

src/sighook.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -291,6 +291,8 @@ static void sigpop(struct siglist *list, struct sighook *hook) {
291291
rcu_update(hook->self, next);
292292
if (next) {
293293
next->self = hook->self;
294+
} else {
295+
list->tail = &list->head;
294296
}
295297
}
296298

tests/sighook.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,13 @@ void check_sighook(void) {
6060
return;
6161
}
6262

63+
// Check that we can unregister and re-register a hook
64+
sigunhook(hook);
65+
hook = sighook(SIGALRM, alrm_hook, NULL, SH_CONTINUE);
66+
if (!bfs_echeck(hook, "sighook(SIGALRM)")) {
67+
return;
68+
}
69+
6370
// Create a timer that sends SIGALRM every 100 microseconds
6471
struct timespec ival = { .tv_nsec = 100 * 1000 };
6572
struct timer *timer = xtimer_start(&ival);

0 commit comments

Comments
 (0)