signal handling: kernel-to-user info leak

Roland McGrath roland at redhat.com
Tue Feb 7 19:55:47 UTC 2006


These issues are separate, and I'd prefer to keep separate issues in
separate threads.

> Somewhat related, the kernel leaks ["garbage"] data from the
> kernel stack when placing the struct siginfo onto the user stack.
> In arch/i386/kernel/signal.c, subroutine do_signal() declares
> an on-stack automatic local
>     siginfo_t info;
> The routine fills in portions without clearing the whole struct,
> then copies the entire struct onto the user stack.

That's inaccurate.  It uses copy_siginfo_to_user (in setup_rt_frame), which
copies only the initialized fields.


Thanks,
Roland




More information about the fedora-devel-list mailing list