Messages in this thread | | | Date | Sat, 29 Jun 2013 11:29:40 -0700 | Subject | Re: [PATCH 3.10-rc7] Fix: kernel/ptrace.c: ptrace_peek_siginfo() missing __put_user() validation | From | Linus Torvalds <> |
| |
On Fri, Jun 28, 2013 at 6:49 AM, Mathieu Desnoyers <mathieu.desnoyers@efficios.com> wrote: > This __put_user() could be used by unprivileged processes to write into > kernel memory. The issue here is that even if copy_siginfo_to_user() > fails, the error code is not checked before __put_user() is executed. > Luckily, ptrace_peek_siginfo() has been added within the 3.10-rc cycle, > so it has not hit a stable release yet.
Why do those stupid
__put_user(info.si_code, &uinfo->si_code))
things exist at all?
As far as I can tell, copy_siginfo_to_user[32]() already copies si_code. Is the field really so important that it has to be copied twice, just to make sure the write makes it?
Ok, ok, I see the explanation in the commit message that introduced this, but it sure as hell isn't obvious from actually looking at the code. I'm applying the patch, but I think this should have been a comment in the code as well.
Linus
| |