Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3c00cb5e authored by Amanieu d'Antras's avatar Amanieu d'Antras Committed by Linus Torvalds
Browse files

signal: fix information leak in copy_siginfo_from_user32 



This function can leak kernel stack data when the user siginfo_t has a
positive si_code value.  The top 16 bits of si_code descibe which fields
in the siginfo_t union are active, but they are treated inconsistently
between copy_siginfo_from_user32, copy_siginfo_to_user32 and
copy_siginfo_to_user.

copy_siginfo_from_user32 is called from rt_sigqueueinfo and
rt_tgsigqueueinfo in which the user has full control overthe top 16 bits
of si_code.

This fixes the following information leaks:
x86:   8 bytes leaked when sending a signal from a 32-bit process to
       itself. This leak grows to 16 bytes if the process uses x32.
       (si_code = __SI_CHLD)
x86:   100 bytes leaked when sending a signal from a 32-bit process to
       a 64-bit process. (si_code = -1)
sparc: 4 bytes leaked when sending a signal from a 32-bit process to a
       64-bit process. (si_code = any)

parsic and s390 have similar bugs, but they are not vulnerable because
rt_[tg]sigqueueinfo have checks that prevent sending a positive si_code
to a different process.  These bugs are also fixed for consistency.

Signed-off-by: default avatarAmanieu d'Antras <amanieu@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Russell King <rmk@arm.linux.org.uk>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Chris Metcalf <cmetcalf@ezchip.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 209f7512

arch/arm64/kernel/signal32.c

+0 −2
Original line number Diff line number Diff line
@@ -201,8 +201,6 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) 


int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)

{

	memset(to, 0, sizeof *to);



	if (copy_from_user(to, from, __ARCH_SI_PREAMBLE_SIZE) ||

	    copy_from_user(to->_sifields._pad,

			   from->_sifields._pad, SI_PAD_SIZE))

arch/mips/kernel/signal32.c

+0 −2
Original line number Diff line number Diff line
@@ -409,8 +409,6 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) 


int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)

{

	memset(to, 0, sizeof *to);



	if (copy_from_user(to, from, 3*sizeof(int)) ||

	    copy_from_user(to->_sifields._pad,

			   from->_sifields._pad, SI_PAD_SIZE32))

arch/powerpc/kernel/signal_32.c

+0 −2
Original line number Diff line number Diff line
@@ -966,8 +966,6 @@ int copy_siginfo_to_user32(struct compat_siginfo __user *d, const siginfo_t *s) 


int copy_siginfo_from_user32(siginfo_t *to, struct compat_siginfo __user *from)

{

	memset(to, 0, sizeof *to);



	if (copy_from_user(to, from, 3*sizeof(int)) ||

	    copy_from_user(to->_sifields._pad,

			   from->_sifields._pad, SI_PAD_SIZE32))

arch/tile/kernel/compat_signal.c

+0 −2
Original line number Diff line number Diff line
@@ -113,8 +113,6 @@ int copy_siginfo_from_user32(siginfo_t *to, struct compat_siginfo __user *from) 
	if (!access_ok(VERIFY_READ, from, sizeof(struct compat_siginfo)))

		return -EFAULT;



	memset(to, 0, sizeof(*to));



	err = __get_user(to->si_signo, &from->si_signo);

	err |= __get_user(to->si_errno, &from->si_errno);

	err |= __get_user(to->si_code, &from->si_code);

kernel/signal.c

+2 −2
Original line number Diff line number Diff line
@@ -3017,7 +3017,7 @@ COMPAT_SYSCALL_DEFINE3(rt_sigqueueinfo, 
			int, sig,

			struct compat_siginfo __user *, uinfo)

{

	siginfo_t info;

	siginfo_t info = {};

	int ret = copy_siginfo_from_user32(&info, uinfo);

	if (unlikely(ret))

		return ret;
@@ -3061,7 +3061,7 @@ COMPAT_SYSCALL_DEFINE4(rt_tgsigqueueinfo, 
			int, sig,

			struct compat_siginfo __user *, uinfo)

{

	siginfo_t info;

	siginfo_t info = {};



	if (copy_siginfo_from_user32(&info, uinfo))

		return -EFAULT;