Skip to content

fix(signal): intercept delivery via dequeue#64

Merged
lacraig2 merged 1 commit into
mainfrom
fix/signal-dequeue-delivery
May 17, 2026
Merged

fix(signal): intercept delivery via dequeue#64
lacraig2 merged 1 commit into
mainfrom
fix/signal-dequeue-delivery

Conversation

@lacraig2
Copy link
Copy Markdown
Contributor

This pull request refactors the signal hooking mechanism in signal_hc.c to use a kretprobe on dequeue_signal instead of a kprobe on __send_signal. This change improves compatibility with newer Linux kernels and provides more reliable signal interception. The code now tracks the relevant task_struct across function entry and return, and updates how signal suppression is performed.

Signal hooking mechanism refactor:

  • Replaces the use of a kprobe on __send_signal with a kretprobe on dequeue_signal, updating initialization and handler logic to match the new probe type. [1] [2]
  • Introduces the signal_probe_data struct to pass the task_struct between entry and return handlers, ensuring accurate context for signal processing. [1] [2]
  • Updates the handlers to retrieve the signal number from the function return value and the task from the probe data, improving accuracy and kernel compatibility.
  • Changes the method for silencing signals: instead of modifying a syscall argument, it now sets the return value directly using igloo_regs_set_return_value.
  • Adds a kernel version check to ensure compatibility with kernel versions 5.0.0 and above when capturing the current task. [1] [2]

@lacraig2 lacraig2 enabled auto-merge (rebase) May 17, 2026 10:31
@lacraig2 lacraig2 merged commit 164674c into main May 17, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant