Dan Rosenberg 982f7c2b2e sys_semctl: fix kernel stack leakage ...

The semctl syscall has several code paths that lead to the leakage of
uninitialized kernel stack memory (namely the IPC_INFO, SEM_INFO,
IPC_STAT, and SEM_STAT commands) during the use of the older, obsolete
version of the semid_ds struct.

The copy_semid_to_user() function declares a semid_ds struct on the stack
and copies it back to the user without initializing or zeroing the
"sem_base", "sem_pending", "sem_pending_last", and "undo" pointers,
allowing the leakage of 16 bytes of kernel stack memory.

The code is still reachable on 32-bit systems - when calling semctl()
newer glibc's automatically OR the IPC command with the IPC_64 flag, but
invoking the syscall directly allows users to use the older versions of
the struct.

Signed-off-by: Dan Rosenberg <[email protected]>
Cc: Manfred Spraul <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

2010-10-01 10:50:58 -07:00

..

compat_mq.c

…

compat.c

…

ipc_sysctl.c

…

ipcns_notifier.c

…

Makefile

…

mq_sysctl.c

…

mqueue.c

switch mqueue to ->evict_inode()

2010-08-09 16:47:58 -04:00

msg.c

…

msgutil.c

…

namespace.c

…

sem.c

sys_semctl: fix kernel stack leakage

2010-10-01 10:50:58 -07:00

shm.c

drop unused dentry argument to ->fsync

2010-05-27 22:05:02 -04:00

syscall.c

…

util.c

…

util.h

…