lkml.org 
[lkml]   [2014]   [Oct]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] posix-timers: fix stack info leak in timer_create()
On Sun, 5 Oct 2014, Oleg Nesterov wrote:
> In any case this all looks confusing to me. sys_timer_create() does
>
> new_timer->sigq->info.si_value = event.sigev_value;
> new_timer->sigq->info.si_tid = new_timer->it_id;
>
> later, this writes to the differents members (_rt and _timer) in the
> same union. But the comment in struct siginfo says that we should use
> _timer. And copy_siginfo_to_user() reports si_tid and si_ptr, this
> again reads _timer and _rt. This should actually work, _sigval should
> have the same offset in both struct's, still it looks confusing imho.

It does.

> Perhaps we should change
>
> #define si_value _sifields._rt._sigval
> #define si_int _sifields._rt._sigval.sival_int
> #define si_ptr _sifields._rt._sigval.sival_ptr
>
> to use _timer instead. Nevermind, this is off-topic.

Well that would cause mqueue, perf and procfs to read/set the timer
fields. Odd as well.

Thanks,

tglx


\
 
 \ /
  Last update: 2014-10-06 00:01    [W:0.070 / U:0.200 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site