* [PATCH] infoleak fix1 in signal
@ 2016-05-03 20:42 Kangjie Lu
2016-05-04 10:38 ` Oleg Nesterov
0 siblings, 1 reply; 2+ messages in thread
From: Kangjie Lu @ 2016-05-03 20:42 UTC (permalink / raw)
To: akpm; +Cc: oleg, peterz, amanieu, linux-kernel, taesoo, insu, Kangjie Lu
The stack object “info” has a total size of 128 bytes; however,
only 28 bytes are initialized. The remaining uninitialized bytes
are sent to userland via send_signal.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
---
kernel/signal.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/signal.c b/kernel/signal.c
index aa9bf00..f40f0b3 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1594,6 +1594,7 @@ bool do_notify_parent(struct task_struct *tsk, int sig)
sig = SIGCHLD;
}
+ memset(&info, 0, sizeof(info));
info.si_signo = sig;
info.si_errno = 0;
/*
--
1.9.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] infoleak fix1 in signal
2016-05-03 20:42 [PATCH] infoleak fix1 in signal Kangjie Lu
@ 2016-05-04 10:38 ` Oleg Nesterov
0 siblings, 0 replies; 2+ messages in thread
From: Oleg Nesterov @ 2016-05-04 10:38 UTC (permalink / raw)
To: Kangjie Lu; +Cc: akpm, peterz, amanieu, linux-kernel, taesoo, insu, Kangjie Lu
On 05/03, Kangjie Lu wrote:
>
> The stack object “info” has a total size of 128 bytes; however,
> only 28 bytes are initialized. The remaining uninitialized bytes
> are sent to userland via send_signal.
Not really, please see copy_siginfo_to_user(), case(__SI_CHLD). All members
copied to user-space are initialized afaics.
> @@ -1594,6 +1594,7 @@ bool do_notify_parent(struct task_struct *tsk, int sig)
> sig = SIGCHLD;
> }
>
> + memset(&info, 0, sizeof(info));
looks like a false alarm to me.
Oleg.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-05-04 10:38 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-05-03 20:42 [PATCH] infoleak fix1 in signal Kangjie Lu
2016-05-04 10:38 ` Oleg Nesterov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox