Messages in this thread | | | Date | Sun, 5 Oct 2014 23:24:47 +0200 (CEST) | From | Thomas Gleixner <> | Subject | Re: [PATCH] posix-timers: fix stack info leak in timer_create() |
| |
On Sun, 5 Oct 2014, Oleg Nesterov wrote: > In any case this all looks confusing to me. sys_timer_create() does > > new_timer->sigq->info.si_value = event.sigev_value; > new_timer->sigq->info.si_tid = new_timer->it_id; > > later, this writes to the differents members (_rt and _timer) in the > same union. But the comment in struct siginfo says that we should use > _timer. And copy_siginfo_to_user() reports si_tid and si_ptr, this > again reads _timer and _rt. This should actually work, _sigval should > have the same offset in both struct's, still it looks confusing imho.
It does.
> Perhaps we should change > > #define si_value _sifields._rt._sigval > #define si_int _sifields._rt._sigval.sival_int > #define si_ptr _sifields._rt._sigval.sival_ptr > > to use _timer instead. Nevermind, this is off-topic.
Well that would cause mqueue, perf and procfs to read/set the timer fields. Odd as well.
Thanks,
tglx
| |