signalfd: fix information leak in signalfd_copyinfo
commit 3ead7c52bd
upstream.
This function may copy the si_addr_lsb field to user mode when it hasn't
been initialized, which can leak kernel stack data to user mode.
Just checking the value of si_code is insufficient because the same
si_code value is shared between multiple signals. This is solved by
checking the value of si_signo in addition to si_code.
Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
wifi-calibration
parent
7f488aad4f
commit
8a97f0e58a
|
@ -121,8 +121,9 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo,
|
|||
* Other callers might not initialize the si_lsb field,
|
||||
* so check explicitly for the right codes here.
|
||||
*/
|
||||
if (kinfo->si_code == BUS_MCEERR_AR ||
|
||||
kinfo->si_code == BUS_MCEERR_AO)
|
||||
if (kinfo->si_signo == SIGBUS &&
|
||||
(kinfo->si_code == BUS_MCEERR_AR ||
|
||||
kinfo->si_code == BUS_MCEERR_AO))
|
||||
err |= __put_user((short) kinfo->si_addr_lsb,
|
||||
&uinfo->ssi_addr_lsb);
|
||||
#endif
|
||||
|
|
Loading…
Reference in New Issue