mqueue: reject mq_notify with signo 0

valid_signal(0) is true; __do_notify() skips signo 0 anyway.

Signed-off-by: Yi Xie <xieyi@kylinos.cn>
Link: https://patch.msgid.link/20260603020936.54508-1-xieyi@kylinos.cn
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 4798b375972bf468a0436adaffe5be22568678c5..fa0b02c68cf1d235b5e86d69553610d1c4d06f7c 100644 (file)
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -790,7 +790,6 @@ static void __do_notify(struct mqueue_inode_info *info)
                        struct kernel_siginfo sig_i;
                        struct task_struct *task;
 
-                       /* do_mq_notify() accepts sigev_signo == 0, why?? */
                        if (!info->notify.sigev_signo)
                                break;
 
@@ -1281,9 +1280,9 @@ static int do_mq_notify(mqd_t mqdes, const struct sigevent *notification)
                             notification->sigev_notify != SIGEV_THREAD))
                        return -EINVAL;
                if (notification->sigev_notify == SIGEV_SIGNAL &&
-                       !valid_signal(notification->sigev_signo)) {
+                   (!notification->sigev_signo ||
+                    !valid_signal(notification->sigev_signo)))
                        return -EINVAL;
-               }
                if (notification->sigev_notify == SIGEV_THREAD) {
                        long timeo;