--- kernel/signal.c

+++ kernel/signal.c

@@ -2351,9 +2351,13 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t,

return -EFAULT;

/* Not even root can pretend to send signals from the kernel.

- Nor can they impersonate a kill(), which adds source info. */

- if (info.si_code >= 0)

+ * Nor can they impersonate a kill()/tgkill(), which adds source info.

+ */

+ if (info.si_code != SI_QUEUE) {

+ /* We used to allow any < 0 si_code */

+ WARN_ON_ONCE(info.si_code < 0);

return -EPERM;

+ }

info.si_signo = sig;

/* POSIX.1b doesn't mention process groups. */

@@ -2367,9 +2371,13 @@ long do_rt_tgsigqueueinfo(pid_t tgid, pi

return -EINVAL;

/* Not even root can pretend to send signals from the kernel.

- Nor can they impersonate a kill(), which adds source info. */

- if (info->si_code >= 0)

+ * Nor can they impersonate a kill()/tgkill(), which adds source info.

+ */

+ if (info->si_code != SI_QUEUE) {

+ /* We used to allow any < 0 si_code */

+ WARN_ON_ONCE(info->si_code < 0);

return -EPERM;

+ }

info->si_signo = sig;

return do_send_specific(tgid, pid, sig, info);