lkml.org 
[lkml]   [2015]   [Oct]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] signal: Make the si_code check in rt_[tg]sigqueueinfo stricter
Date
rt_sigqueueinfo and rt_tgsigqueueinfo check the value of si_code to
prevent a process from spoofing a kernel-generated signal or one
generated by kill/tgkill.

Unfortunately this check failed to take into account the fact that
the si_code value seen by a user process is only the low 16 bits of
the value in the kernel. It was still possible to spoof any si_code
by ORing 0xffff into the top 16 bits.

The check is tightened by checking the value of si_code that will
be seen by a user program instead of the one in the kernel.

Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
---
kernel/signal.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/signal.c b/kernel/signal.c
index 0f6bbbe..f3d4f39 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2989,7 +2989,7 @@ static int do_rt_sigqueueinfo(pid_t pid, int sig, siginfo_t *info)
/* Not even root can pretend to send signals from the kernel.
* Nor can they impersonate a kill()/tgkill(), which adds source info.
*/
- if ((info->si_code >= 0 || info->si_code == SI_TKILL) &&
+ if (((short)info->si_code >= 0 || (short)info->si_code == SI_TKILL) &&
(task_pid_vnr(current) != pid))
return -EPERM;

@@ -3037,7 +3037,7 @@ static int do_rt_tgsigqueueinfo(pid_t tgid, pid_t pid, int sig, siginfo_t *info)
/* Not even root can pretend to send signals from the kernel.
* Nor can they impersonate a kill()/tgkill(), which adds source info.
*/
- if ((info->si_code >= 0 || info->si_code == SI_TKILL) &&
+ if (((short)info->si_code >= 0 || (short)info->si_code == SI_TKILL) &&
(task_pid_vnr(current) != pid))
return -EPERM;

--
2.6.1


\
 
 \ /
  Last update: 2015-10-12 18:01    [W:0.049 / U:0.200 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site