Fix: kernel/ptrace.c: ptrace_peek_siginfo() missing __put_user() validation
This __put_user() could be used by unprivileged processes to write into kernel memory. The issue here is that even if copy_siginfo_to_user() fails, the error code is not checked before __put_user() is executed. Luckily, ptrace_peek_siginfo() has been added within the 3.10-rc cycle, so it has not hit a stable release yet. Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Acked-by: Oleg Nesterov <oleg@redhat.com> Cc: Andrey Vagin <avagin@openvz.org> Cc: Roland McGrath <roland@redhat.com> Cc: Paul McKenney <paulmck@linux.vnet.ibm.com> Cc: David Howells <dhowells@redhat.com> Cc: Dave Jones <davej@redhat.com> Cc: Pavel Emelyanov <xemul@parallels.com> Cc: Pedro Alves <palves@redhat.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Родитель
bd2931b5cf
Коммит
706b23bde2
|
@ -665,20 +665,22 @@ static int ptrace_peek_siginfo(struct task_struct *child,
|
|||
if (unlikely(is_compat_task())) {
|
||||
compat_siginfo_t __user *uinfo = compat_ptr(data);
|
||||
|
||||
ret = copy_siginfo_to_user32(uinfo, &info);
|
||||
ret |= __put_user(info.si_code, &uinfo->si_code);
|
||||
if (copy_siginfo_to_user32(uinfo, &info) ||
|
||||
__put_user(info.si_code, &uinfo->si_code)) {
|
||||
ret = -EFAULT;
|
||||
break;
|
||||
}
|
||||
|
||||
} else
|
||||
#endif
|
||||
{
|
||||
siginfo_t __user *uinfo = (siginfo_t __user *) data;
|
||||
|
||||
ret = copy_siginfo_to_user(uinfo, &info);
|
||||
ret |= __put_user(info.si_code, &uinfo->si_code);
|
||||
}
|
||||
|
||||
if (ret) {
|
||||
ret = -EFAULT;
|
||||
break;
|
||||
if (copy_siginfo_to_user(uinfo, &info) ||
|
||||
__put_user(info.si_code, &uinfo->si_code)) {
|
||||
ret = -EFAULT;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
data += sizeof(siginfo_t);
|
||||
|
|
Загрузка…
Ссылка в новой задаче