linux/arch/powerpc
Amanieu d'Antras 3c00cb5e68 signal: fix information leak in copy_siginfo_from_user32
This function can leak kernel stack data when the user siginfo_t has a
positive si_code value.  The top 16 bits of si_code descibe which fields
in the siginfo_t union are active, but they are treated inconsistently
between copy_siginfo_from_user32, copy_siginfo_to_user32 and
copy_siginfo_to_user.

copy_siginfo_from_user32 is called from rt_sigqueueinfo and
rt_tgsigqueueinfo in which the user has full control overthe top 16 bits
of si_code.

This fixes the following information leaks:
x86:   8 bytes leaked when sending a signal from a 32-bit process to
       itself. This leak grows to 16 bytes if the process uses x32.
       (si_code = __SI_CHLD)
x86:   100 bytes leaked when sending a signal from a 32-bit process to
       a 64-bit process. (si_code = -1)
sparc: 4 bytes leaked when sending a signal from a 32-bit process to a
       64-bit process. (si_code = any)

parsic and s390 have similar bugs, but they are not vulnerable because
rt_[tg]sigqueueinfo have checks that prevent sending a positive si_code
to a different process.  These bugs are also fixed for consistency.

Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Russell King <rmk@arm.linux.org.uk>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Chris Metcalf <cmetcalf@ezchip.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-08-07 04:39:40 +03:00
..
boot Devicetree changes for v4.2 2015-07-01 19:40:18 -07:00
configs Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/scottwood/linux into next 2015-06-19 17:23:48 +10:00
crypto crypto: powerpc/md5 - use md5 IV MD5_HX instead of their raw value 2015-05-18 12:20:20 +08:00
include Merge branch 'akpm' (patches from Andrew) 2015-06-26 09:52:05 -07:00
kernel signal: fix information leak in copy_siginfo_from_user32 2015-08-07 04:39:40 +03:00
kvm The bulk of the changes here is for x86. And for once it's not 2015-06-24 09:36:49 -07:00
lib powerpc updates for 4.2 2015-06-24 08:46:32 -07:00
math-emu
mm powerpc: Add plain English description for alignment exception oopses 2015-07-06 20:24:35 +10:00
net ppc: bpf: Add SKF_AD_CPU for ppc32 2015-02-20 15:19:43 -05:00
oprofile powerpc/oprofile: reduce mmap_sem hold for exe_file 2015-04-17 09:04:11 -04:00
perf powerpc/perf/24x7: Fix lockdep warning 2015-07-08 15:18:04 +10:00
platforms powerpc/eeh-powernv: Fix unbalanced IRQ warning 2015-07-30 19:01:32 +10:00
sysdev powerpc/ppc4xx_hsta_msi: Include ppc-pci.h to fix reference to hose_list 2015-07-06 20:24:36 +10:00
xmon powerpc updates for 3.20 2015-02-11 18:15:38 -08:00
Kconfig EDAC: Cleanup atomic_scrub mess 2015-05-28 15:31:53 +02:00
Kconfig.debug powerpc: Make STRICT_MM_TYPECHECKS a config option 2015-05-11 19:53:59 +10:00
Makefile powerpc: Don't use gcc specific options on clang 2015-06-11 17:33:05 +10:00
relocs_check.sh powerpc: Convert relocs_check to a shell script using grep 2015-03-23 14:47:39 +11:00