Amanieu d'Antras 52124831a3 signal: fix information leak in copy_siginfo_from_user32 ... commit 3c00cb5e68 upstream. This function can leak kernel stack data when the user siginfo_t has a positive si_code value. The top 16 bits of si_code descibe which fields in the siginfo_t union are active, but they are treated inconsistently between copy_siginfo_from_user32, copy_siginfo_to_user32 and copy_siginfo_to_user. copy_siginfo_from_user32 is called from rt_sigqueueinfo and rt_tgsigqueueinfo in which the user has full control overthe top 16 bits of si_code. This fixes the following information leaks: x86: 8 bytes leaked when sending a signal from a 32-bit process to itself. This leak grows to 16 bytes if the process uses x32. (si_code = __SI_CHLD) x86: 100 bytes leaked when sending a signal from a 32-bit process to a 64-bit process. (si_code = -1) sparc: 4 bytes leaked when sending a signal from a 32-bit process to a 64-bit process. (si_code = any) parsic and s390 have similar bugs, but they are not vulnerable because rt_[tg]sigqueueinfo have checks that prevent sending a positive si_code to a different process. These bugs are also fixed for consistency. Signed-off-by: Amanieu d'Antras <amanieu@gmail.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Ingo Molnar <mingo@kernel.org> Cc: Russell King <rmk@arm.linux.org.uk> Cc: Ralf Baechle <ralf@linux-mips.org> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Chris Metcalf <cmetcalf@ezchip.com> Cc: Paul Mackerras <paulus@samba.org> Cc: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2015-08-16 20:52:26 -07:00
..
configs	netpoll: delete defconfig references to obsolete NETPOLL_TRAP	2014-11-29 21:13:48 -08:00
gxio	ptp: tilegx: convert to the 64 bit get/set time methods.	2015-03-31 12:01:18 -04:00
include	Merge git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile	2015-04-17 16:03:05 -04:00
kernel	signal: fix information leak in copy_siginfo_from_user32	2015-08-16 20:52:26 -07:00
kvm	rcu: Make SRCU optional by using CONFIG_SRCU	2015-01-06 11:04:29 -08:00
lib	tile: include: asm: use 'long long' instead of 'u64' for atomic64_t and its related functions	2013-09-27 16:08:56 -04:00
mm	tile: map data region shadow of kernel as R/W	2015-04-17 14:01:35 -04:00
Kbuild	arch/tile: core support for Tilera 32-bit chips.	2010-06-04 17:11:18 -04:00
Kconfig	Merge git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile	2015-04-17 16:03:05 -04:00
Kconfig.debug	tile: remove DEBUG_EXTRA_FLAGS kernel config option	2013-09-03 14:52:17 -04:00
Makefile	tile: remove DEBUG_EXTRA_FLAGS kernel config option	2013-09-03 14:52:17 -04:00