signal handling: kernel-to-user info leak
Roland McGrath
roland at redhat.com
Tue Feb 7 19:55:47 UTC 2006
These issues are separate, and I'd prefer to keep separate issues in
separate threads.
> Somewhat related, the kernel leaks ["garbage"] data from the
> kernel stack when placing the struct siginfo onto the user stack.
> In arch/i386/kernel/signal.c, subroutine do_signal() declares
> an on-stack automatic local
> siginfo_t info;
> The routine fills in portions without clearing the whole struct,
> then copies the entire struct onto the user stack.
That's inaccurate. It uses copy_siginfo_to_user (in setup_rt_frame), which
copies only the initialized fields.
Thanks,
Roland
More information about the fedora-devel-list
mailing list