signal: fix information leak in copy_siginfo_to_user

Browse source

commit 26135022f8 upstream.

This function may copy the si_addr_lsb, si_lower and si_upper fields to
user mode when they haven't been initialized, which can leak kernel
stack data to user mode.

Just checking the value of si_code is insufficient because the same
si_code value is shared between multiple signals.  This is solved by
checking the value of si_signo in addition to si_code.

Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Russell King <rmk@arm.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[ luis: backported to 3.16:
  - dropped 2nd hunk in kernel/signal.c ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

...

This commit is contained in:

Amanieu d'Antras 2015-08-06 15:46:29 -07:00 • committed by Luis Henriques

parent 3a6d9db06b

commit 1f1fa26a76

2 changed files with 4 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

arch/arm64/kernel/signal32.c

View file

3

kernel/signal.c

View file