Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e723e3f7 authored by Maciej W. Rozycki's avatar Maciej W. Rozycki Committed by Ralf Baechle
Browse files

MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' 



Avoid sending a partially initialised `siginfo_t' structure along SIGFPE
signals issued from `do_ov' and `do_trap_or_bp', leading to information
leaking from the kernel stack.

Signed-off-by: default avatarMaciej W. Rozycki <macro@imgtec.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
parent 887349f6

arch/mips/kernel/traps.c

+6 −7
Original line number Diff line number Diff line
@@ -690,15 +690,15 @@ static int simulate_sync(struct pt_regs *regs, unsigned int opcode) 
asmlinkage void do_ov(struct pt_regs *regs)

{

	enum ctx_state prev_state;

	siginfo_t info;

	siginfo_t info = {

		.si_signo = SIGFPE,

		.si_code = FPE_INTOVF,

		.si_addr = (void __user *)regs->cp0_epc,

	};



	prev_state = exception_enter();

	die_if_kernel("Integer overflow", regs);



	info.si_code = FPE_INTOVF;

	info.si_signo = SIGFPE;

	info.si_errno = 0;

	info.si_addr = (void __user *) regs->cp0_epc;

	force_sig_info(SIGFPE, &info, current);

	exception_exit(prev_state);

}
@@ -874,7 +874,7 @@ asmlinkage void do_fpe(struct pt_regs *regs, unsigned long fcr31) 
void do_trap_or_bp(struct pt_regs *regs, unsigned int code,

	const char *str)

{

	siginfo_t info;

	siginfo_t info = { 0 };

	char b[40];



#ifdef CONFIG_KGDB_LOW_LEVEL_TRAP
@@ -903,7 +903,6 @@ void do_trap_or_bp(struct pt_regs *regs, unsigned int code, 
		else

			info.si_code = FPE_INTOVF;

		info.si_signo = SIGFPE;

		info.si_errno = 0;

		info.si_addr = (void __user *) regs->cp0_epc;

		force_sig_info(SIGFPE, &info, current);

		break;