mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-01-22 14:55:02 +07:00
3c00cb5e68
This function can leak kernel stack data when the user siginfo_t has a
positive si_code value. The top 16 bits of si_code descibe which fields
in the siginfo_t union are active, but they are treated inconsistently
between copy_siginfo_from_user32, copy_siginfo_to_user32 and
copy_siginfo_to_user.
copy_siginfo_from_user32 is called from rt_sigqueueinfo and
rt_tgsigqueueinfo in which the user has full control overthe top 16 bits
of si_code.
This fixes the following information leaks:
x86: 8 bytes leaked when sending a signal from a 32-bit process to
itself. This leak grows to 16 bytes if the process uses x32.
(si_code = __SI_CHLD)
x86: 100 bytes leaked when sending a signal from a 32-bit process to
a 64-bit process. (si_code = -1)
sparc: 4 bytes leaked when sending a signal from a 32-bit process to a
64-bit process. (si_code = any)
parsic and s390 have similar bugs, but they are not vulnerable because
rt_[tg]sigqueueinfo have checks that prevent sending a positive si_code
to a different process. These bugs are also fixed for consistency.
Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Russell King <rmk@arm.linux.org.uk>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Chris Metcalf <cmetcalf@ezchip.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||
|---|---|---|
| .. | ||
| vdso32 | ||
| vdso64 | ||
| .gitignore | ||
| align.c | ||
| asm-offsets.c | ||
| audit.c | ||
| btext.c | ||
| cacheinfo.c | ||
| cacheinfo.h | ||
| compat_audit.c | ||
| cpu_setup_6xx.S | ||
| cpu_setup_44x.S | ||
| cpu_setup_fsl_booke.S | ||
| cpu_setup_pa6t.S | ||
| cpu_setup_power.S | ||
| cpu_setup_ppc970.S | ||
| cputable.c | ||
| crash_dump.c | ||
| crash.c | ||
| dbell.c | ||
| dma-iommu.c | ||
| dma-swiotlb.c | ||
| dma.c | ||
| eeh_cache.c | ||
| eeh_dev.c | ||
| eeh_driver.c | ||
| eeh_event.c | ||
| eeh_pe.c | ||
| eeh_sysfs.c | ||
| eeh.c | ||
| entry_32.S | ||
| entry_64.S | ||
| epapr_hcalls.S | ||
| epapr_paravirt.c | ||
| exceptions-64e.S | ||
| exceptions-64s.S | ||
| fadump.c | ||
| firmware.c | ||
| fpu.S | ||
| fsl_booke_entry_mapping.S | ||
| ftrace.c | ||
| head_8xx.S | ||
| head_32.S | ||
| head_40x.S | ||
| head_44x.S | ||
| head_64.S | ||
| head_booke.h | ||
| head_fsl_booke.S | ||
| hw_breakpoint.c | ||
| ibmebus.c | ||
| idle_6xx.S | ||
| idle_book3e.S | ||
| idle_e500.S | ||
| idle_power4.S | ||
| idle_power7.S | ||
| idle.c | ||
| io-workarounds.c | ||
| io.c | ||
| iomap.c | ||
| iommu.c | ||
| irq.c | ||
| isa-bridge.c | ||
| jump_label.c | ||
| kgdb.c | ||
| kprobes.c | ||
| kvm_emul.S | ||
| kvm.c | ||
| l2cr_6xx.S | ||
| legacy_serial.c | ||
| machine_kexec_32.c | ||
| machine_kexec_64.c | ||
| machine_kexec.c | ||
| Makefile | ||
| mce_power.c | ||
| mce.c | ||
| misc_32.S | ||
| misc_64.S | ||
| misc.S | ||
| module_32.c | ||
| module_64.c | ||
| module.c | ||
| msi.c | ||
| nvram_64.c | ||
| of_platform.c | ||
| paca.c | ||
| pci_32.c | ||
| pci_64.c | ||
| pci_dn.c | ||
| pci_of_scan.c | ||
| pci-common.c | ||
| pci-hotplug.c | ||
| pmc.c | ||
| ppc32.h | ||
| ppc_ksyms_32.c | ||
| ppc_ksyms.c | ||
| ppc_save_regs.S | ||
| proc_powerpc.c | ||
| process.c | ||
| prom_init_check.sh | ||
| prom_init.c | ||
| prom_parse.c | ||
| prom.c | ||
| ptrace32.c | ||
| ptrace.c | ||
| reloc_32.S | ||
| reloc_64.S | ||
| rtas_flash.c | ||
| rtas_pci.c | ||
| rtas-proc.c | ||
| rtas-rtc.c | ||
| rtas.c | ||
| rtasd.c | ||
| setup_32.c | ||
| setup_64.c | ||
| setup-common.c | ||
| signal_32.c | ||
| signal_64.c | ||
| signal.c | ||
| signal.h | ||
| smp-tbsync.c | ||
| smp.c | ||
| stacktrace.c | ||
| suspend.c | ||
| swsusp_32.S | ||
| swsusp_64.c | ||
| swsusp_asm64.S | ||
| swsusp_booke.S | ||
| swsusp.c | ||
| sys_ppc32.c | ||
| syscalls.c | ||
| sysfs.c | ||
| systbl_chk.c | ||
| systbl_chk.sh | ||
| systbl.S | ||
| tau_6xx.c | ||
| time.c | ||
| tm.S | ||
| traps.c | ||
| udbg_16550.c | ||
| udbg.c | ||
| uprobes.c | ||
| vdso.c | ||
| vecemu.c | ||
| vector.S | ||
| vio.c | ||
| vmlinux.lds.S | ||