From: "Amanieu d'Antras" <amanieu@gmail.com>
To: linux-kernel@vger.kernel.org
Cc: Oleg Nesterov <oleg@redhat.com>,
"Amanieu d'Antras" <amanieu@gmail.com>,
Alexander Viro <viro@zeniv.linux.org.uk>,
linux-fsdevel@vger.kernel.org
Subject: [PATCH v2 19/20] signalfd: Fix some issues in signalfd_copyinfo
Date: Thu, 5 Nov 2015 00:50:38 +0000 [thread overview]
Message-ID: <1446684640-4112-20-git-send-email-amanieu@gmail.com> (raw)
In-Reply-To: <1446684640-4112-1-git-send-email-amanieu@gmail.com>
There are several issues here:
1) The value of ssi_ptr was incorrect for compat tasks. It was
previously copied directly from si_ptr, which contains garbage
for 32-bit processes, especially on big-endian architectures.
2) A SIGSYS would cause various fields to be filled with incorrect
values. SIGSYS fields are not in signalfd_siginfo, and it should
avoid filling in unrelated fields.
3) ssi_ptr and ssi_int should not be filled in for any unrecognized
si_code, but only for those generated by sigqueue. The si_ptr
and si_int fields in siginfo_t may not be initialized otherwise.
4) ssi_ptr and ssi_addr values for compat tasks did not match those
generated by 32-bit kernels. The values need to be sign-extended
to 64 bits rather than zero-extended.
Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
---
fs/signalfd.c | 58 ++++++++++++++++++++++++++++++++++++++++++----------------
1 file changed, 42 insertions(+), 16 deletions(-)
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 270221f..1c0bde7 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -80,39 +80,66 @@ static unsigned int signalfd_poll(struct file *file, poll_table *wait)
static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo,
siginfo_t const *kinfo)
{
- long err;
+ long err, ssi_ptr, ssi_addr;
BUILD_BUG_ON(sizeof(struct signalfd_siginfo) != 128);
/*
+ * ssi_ptr for a compat task should be sourced from si_int instead
+ * of si_ptr since that is what copy_siginfo_from_user32 and
+ * get_compat_sigevent use. 32-bit pointer values are sign-extended
+ * to 64 bits when written to ssi_ptr, which matches the behavior of
+ * 32-bit kernels.
+ */
+ ssi_ptr = is_compat_task() ? kinfo->si_int : (long) kinfo->si_ptr;
+
+ /*
* Unused members should be zero ...
*/
err = __clear_user(uinfo, sizeof(*uinfo));
/*
- * If you change siginfo_t structure, please be sure
- * this code is fixed accordingly.
+ * If you change siginfo_t structure, please be sure that
+ * all these functions are fixed accordingly:
+ * copy_siginfo_to_user
+ * copy_siginfo_to_user32
+ * copy_siginfo_from_user32
+ * signalfd_copyinfo
+ * They should never copy any pad contained in the structure
+ * to avoid security leaks, but must copy the generic
+ * 3 ints plus the relevant union member.
*/
err |= __put_user(kinfo->si_signo, &uinfo->ssi_signo);
err |= __put_user(kinfo->si_errno, &uinfo->ssi_errno);
err |= __put_user((short) kinfo->si_code, &uinfo->ssi_code);
+ if (kinfo->si_code < 0) {
+ /* Grab some standard fields for sigqueue()-generated signals */
+ err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
+ err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
+ err |= __put_user(ssi_ptr, &uinfo->ssi_ptr);
+ err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
+ return err ? -EFAULT : sizeof(*uinfo);
+ }
switch (kinfo->si_code & __SI_MASK) {
case __SI_KILL:
err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
break;
case __SI_TIMER:
- err |= __put_user(kinfo->si_tid, &uinfo->ssi_tid);
- err |= __put_user(kinfo->si_overrun, &uinfo->ssi_overrun);
- err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
- err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
+ err |= __put_user(kinfo->si_tid, &uinfo->ssi_tid);
+ err |= __put_user(kinfo->si_overrun, &uinfo->ssi_overrun);
+ err |= __put_user(ssi_ptr, &uinfo->ssi_ptr);
+ err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
break;
case __SI_POLL:
err |= __put_user(kinfo->si_band, &uinfo->ssi_band);
err |= __put_user(kinfo->si_fd, &uinfo->ssi_fd);
break;
case __SI_FAULT:
- err |= __put_user((long) kinfo->si_addr, &uinfo->ssi_addr);
+ /* Ensure that ssi_addr is sign-extended to 64 bits */
+ ssi_addr = is_compat_task() ? (int)(long) kinfo->si_addr :
+ (long) kinfo->si_addr;
+ err |= __put_user(ssi_addr, &uinfo->ssi_addr);
#ifdef __ARCH_SI_TRAPNO
err |= __put_user(kinfo->si_trapno, &uinfo->ssi_trapno);
#endif
@@ -139,21 +166,20 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo,
case __SI_MESGQ: /* But this is */
err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
- err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
+ err |= __put_user(ssi_ptr, &uinfo->ssi_ptr);
err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
break;
- default:
- /*
- * This case catches also the signals queued by sigqueue().
- */
+#ifdef __ARCH_SIGSYS
+ case __SI_SYS: /* SIGSYS fields are not in signalfd_siginfo */
+ break;
+#endif
+ default: /* this is just in case for now ... */
err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
- err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
- err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
break;
}
- return err ? -EFAULT: sizeof(*uinfo);
+ return err ? -EFAULT : sizeof(*uinfo);
}
static ssize_t signalfd_dequeue(struct signalfd_ctx *ctx, siginfo_t *info,
--
2.6.2
next prev parent reply other threads:[~2015-11-05 0:52 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-05 0:50 [PATCH v2 00/20] Fix handling of compat_siginfo_t Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 01/20] compat: Add generic compat_siginfo_t Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 02/20] compat: Add generic copy_siginfo_{to,from}_user32 Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 03/20] x86: Update compat_siginfo_t to be closer to the generic version Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 04/20] x86: Rewrite copy_siginfo_{to,from}_user32 Amanieu d'Antras
2015-11-05 2:29 ` H. Peter Anvin
2015-11-05 0:50 ` [PATCH v2 05/20] mips: Clean up compat_siginfo_t Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 06/20] mips: Use generic copy_siginfo_{to,from}_user32 Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 07/20] arm64: Use generic compat_siginfo_t Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 08/20] arm64: Use generic copy_siginfo_{to,from}_user32 Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 09/20] parisc: Use generic compat_siginfo_t Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 10/20] parsic: Use generic copy_siginfo_{to,from}_user32 Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 11/20] s390: Use generic compat_siginfo_t Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 12/20] s390: Use generic copy_siginfo_{to,from}_user32 Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 13/20] powerpc: Use generic compat_siginfo_t Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 14/20] powerpc: Use generic copy_siginfo_{to,from}_user32 Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 15/20] tile: Use generic compat_siginfo_t Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 16/20] tile: Use generic copy_siginfo_{to,from}_user32 Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 17/20] sparc: Use generic compat_siginfo_t Amanieu d'Antras
2015-11-05 0:50 ` [PATCH v2 18/20] sparc: Use generic copy_siginfo_{to,from}_user32 Amanieu d'Antras
2015-11-05 0:50 ` Amanieu d'Antras [this message]
2015-11-05 0:50 ` [PATCH v2 20/20] signal: Remove unnecessary zero-initialization of siginfo_t Amanieu d'Antras
2015-11-08 5:09 ` [PATCH v2 00/20] Fix handling of compat_siginfo_t Andy Lutomirski
2015-11-09 15:12 ` Oleg Nesterov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1446684640-4112-20-git-send-email-amanieu@gmail.com \
--to=amanieu@gmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=oleg@redhat.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).