When a child process exits, it sends exit_signal to its parent via do_notify_parent(). The clone() syscall constructs exit_signal as: (lower_32_bits(clone_flags) & CSIGNAL) CSIGNAL is 0xff, so values in the range 65-255 are possible. However, valid_signal() only accepts signals up to _NSIG (64 on x86_64), causing a WARN_ON in do_notify_parent() when the process exits: WARNING: kernel/signal.c:2174 do_notify_parent+0xc7e/0xd70 The syzkaller reproducer triggers this by calling clone() with flags=0x80, resulting in exit_signal = (0x80 & CSIGNAL) = 128, which exceeds _NSIG and is not a valid signal. The comment above kernel_clone() states that callers are expected to validate exit_signal. clone3() correctly does this: if (unlikely((args.exit_signal & ~((u64)CSIGNAL)) || !valid_signal(args.exit_signal))) return -EINVAL; The clone() syscall has no such check. Add the missing valid_signal() check to clone(), consistent with the existing validation in clone3(). Fixes: 3f2c788a1314 ("fork: prevent accidental access to clone3 features") Reported-by: syzbot+bbe6b99feefc3a0842de@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bbe6b99feefc3a0842de Tested-by: syzbot+bbe6b99feefc3a0842de@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey --- kernel/fork.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/fork.c b/kernel/fork.c index 947a8dbce06a..dbe26ac6ca10 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2845,7 +2845,8 @@ SYSCALL_DEFINE5(clone, unsigned long, clone_flags, unsigned long, newsp, .stack = newsp, .tls = tls, }; - + if (!valid_signal(args.exit_signal)) + return -EINVAL; return kernel_clone(&args); } #endif -- 2.43.0