Quoting Kees Cook ([email protected]): > From: Emese Revfy <[email protected]> > > This fixes a kernel memory contents leak via the tkill and tgkill syscalls > for compat processes. > > This is visible in the siginfo_t->_sifields._rt.si_sigval.sival_ptr field > when handling signals delivered from tkill. > > The place of the infoleak: > > int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from) > { > ... > put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr); > ... > } > > Signed-off-by: Emese Revfy <[email protected]>
Sorry, not sure if this is applied yet, Acked-by: Serge Hallyn <[email protected]> > Reviewed-by: PaX Team <[email protected]> > Signed-off-by: Kees Cook <[email protected]> > Cc: [email protected] > --- > kernel/signal.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/signal.c b/kernel/signal.c > index dd72567..598dc06 100644 > --- a/kernel/signal.c > +++ b/kernel/signal.c > @@ -2948,7 +2948,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct > siginfo *info) > > static int do_tkill(pid_t tgid, pid_t pid, int sig) > { > - struct siginfo info; > + struct siginfo info = {}; > > info.si_signo = sig; > info.si_errno = 0; > -- > 1.7.9.5 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to [email protected] > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
