Messages in this thread Patch in this message | | | From | Peilin Ye <> | Subject | [Linux-kernel-mentees] [PATCH] ptrace: Prevent kernel-infoleak in ptrace_get_syscall_info() | Date | Mon, 27 Jul 2020 17:36:44 -0400 |
| |
ptrace_get_syscall_info() is copying uninitialized stack memory to userspace due to the compiler not initializing holes in statically allocated structures. Fix it by initializing `info` with memset().
Cc: stable@vger.kernel.org Fixes: 201766a20e30 ("ptrace: add PTRACE_GET_SYSCALL_INFO request") Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com> --- kernel/ptrace.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/kernel/ptrace.c b/kernel/ptrace.c index 43d6179508d6..e48d05b765b5 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -960,15 +960,17 @@ ptrace_get_syscall_info(struct task_struct *child, unsigned long user_size, void __user *datavp) { struct pt_regs *regs = task_pt_regs(child); - struct ptrace_syscall_info info = { - .op = PTRACE_SYSCALL_INFO_NONE, - .arch = syscall_get_arch(child), - .instruction_pointer = instruction_pointer(regs), - .stack_pointer = user_stack_pointer(regs), - }; + struct ptrace_syscall_info info; unsigned long actual_size = offsetof(struct ptrace_syscall_info, entry); unsigned long write_size; + memset(&info, 0, sizeof(info)); + + info.op = PTRACE_SYSCALL_INFO_NONE; + info.arch = syscall_get_arch(child); + info.instruction_pointer = instruction_pointer(regs); + info.stack_pointer = user_stack_pointer(regs); + /* * This does not need lock_task_sighand() to access * child->last_siginfo because ptrace_freeze_traced() -- 2.25.1
| |