tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Fix: kernel/ptrace.c: ptrace_peek_siginfo() missing __put_user() validation

This __put_user() could be used by unprivileged processes to write into
kernel memory. The issue here is that even if copy_siginfo_to_user()
fails, the error code is not checked before __put_user() is executed.

Luckily, ptrace_peek_siginfo() has been added within the 3.10-rc cycle,
so it has not hit a stable release yet.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Cc: Andrey Vagin <avagin@openvz.org>
Cc: Roland McGrath <roland@redhat.com>
Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Dave Jones <davej@redhat.com>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Pedro Alves <palves@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Mathieu Desnoyers and committed by
Linus Torvalds 706b23bd bd2931b5

+11 -9
+11 -9
kernel/ptrace.c
··· 665 665 if (unlikely(is_compat_task())) { 666 666 compat_siginfo_t __user *uinfo = compat_ptr(data); 667 667 668 - ret = copy_siginfo_to_user32(uinfo, &info); 669 - ret |= __put_user(info.si_code, &uinfo->si_code); 668 + if (copy_siginfo_to_user32(uinfo, &info) || 669 + __put_user(info.si_code, &uinfo->si_code)) { 670 + ret = -EFAULT; 671 + break; 672 + } 673 + 670 674 } else 671 675 #endif 672 676 { 673 677 siginfo_t __user *uinfo = (siginfo_t __user *) data; 674 678 675 - ret = copy_siginfo_to_user(uinfo, &info); 676 - ret |= __put_user(info.si_code, &uinfo->si_code); 677 - } 678 - 679 - if (ret) { 680 - ret = -EFAULT; 681 - break; 679 + if (copy_siginfo_to_user(uinfo, &info) || 680 + __put_user(info.si_code, &uinfo->si_code)) { 681 + ret = -EFAULT; 682 + break; 683 + } 682 684 } 683 685 684 686 data += sizeof(siginfo_t);