From: Yi Xie <xieyi@kylinos.cn>
Date: Wed, 3 Jun 2026 02:09:36 +0000 (+0800)
Subject: mqueue: reject mq_notify with signo 0
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=1184f5e8200902cae3e098ac68d8600ecdf6fe28;p=thirdparty%2Flinux.git

mqueue: reject mq_notify with signo 0

valid_signal(0) is true; __do_notify() skips signo 0 anyway.

Signed-off-by: Yi Xie <xieyi@kylinos.cn>
Link: https://patch.msgid.link/20260603020936.54508-1-xieyi@kylinos.cn
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 4798b375972bf..fa0b02c68cf1d 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -790,7 +790,6 @@ static void __do_notify(struct mqueue_inode_info *info)
 			struct kernel_siginfo sig_i;
 			struct task_struct *task;
 
-			/* do_mq_notify() accepts sigev_signo == 0, why?? */
 			if (!info->notify.sigev_signo)
 				break;
 
@@ -1281,9 +1280,9 @@ static int do_mq_notify(mqd_t mqdes, const struct sigevent *notification)
 			     notification->sigev_notify != SIGEV_THREAD))
 			return -EINVAL;
 		if (notification->sigev_notify == SIGEV_SIGNAL &&
-			!valid_signal(notification->sigev_signo)) {
+		    (!notification->sigev_signo ||
+		     !valid_signal(notification->sigev_signo)))
 			return -EINVAL;
-		}
 		if (notification->sigev_notify == SIGEV_THREAD) {
 			long timeo;