On Mon, Oct 12, 2015 at 4:54 PM, Oleg Nesterov <[email protected]> wrote: > Yes, copy_siginfo_to_user() does __put_user((short)from->si_code). > But SI_FROMUSER/SI_FROMKERNEL are internal kernel checks, we mostly > use them in copy_siginfo_to_user(). > > And note that if ->si_code < 0 we simply do __copy_to_user(), so > userspace can't see something which looks like "from kernel", in > this case we do not truncate ->si_code.
Ah my bad, I seem to have missed that case. So copy_siginfo_to_user seems to be safe, but it is still an issue for copy_siginfo_to_user32 which doesn't have this check. Maybe this should be fixed in the compat code instead? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
