| From 854fbd6e5f60fe99e8e3a569865409fca378f143 Mon Sep 17 00:00:00 2001 |
| From: Kees Cook <keescook@chromium.org> |
| Date: Thu, 23 Mar 2017 15:46:16 -0700 |
| Subject: [PATCH] lib/syscall: Clear return values when no stack |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| commit 854fbd6e5f60fe99e8e3a569865409fca378f143 upstream. |
| |
| Commit: |
| |
| aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()") |
| |
| ... added logic to handle a process stack not existing, but left sp and pc |
| uninitialized, which can be later reported via /proc/$pid/syscall for zombie |
| processes, potentially exposing kernel memory to userspace. |
| |
| Zombie /proc/$pid/syscall before: |
| -1 0xffffffff9a060100 0xffff92f42d6ad900 |
| |
| Zombie /proc/$pid/syscall after: |
| -1 0x0 0x0 |
| |
| Reported-by: Robert Święcki <robert@swiecki.net> |
| Signed-off-by: Kees Cook <keescook@chromium.org> |
| Reviewed-by: Andy Lutomirski <luto@kernel.org> |
| Cc: Borislav Petkov <bp@alien8.de> |
| Cc: Brian Gerst <brgerst@gmail.com> |
| Cc: Denys Vlasenko <dvlasenk@redhat.com> |
| Cc: H. Peter Anvin <hpa@zytor.com> |
| Cc: Josh Poimboeuf <jpoimboe@redhat.com> |
| Cc: Linus Torvalds <torvalds@linux-foundation.org> |
| Cc: Peter Zijlstra <peterz@infradead.org> |
| Cc: Thomas Gleixner <tglx@linutronix.de> |
| Cc: stable@vger.kernel.org # v4.9+ |
| Fixes: aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()") |
| Link: http://lkml.kernel.org/r/20170323224616.GA92694@beast |
| Signed-off-by: Ingo Molnar <mingo@kernel.org> |
| |
| diff --git a/lib/syscall.c b/lib/syscall.c |
| index 17d5ff5fa6a3..2c6cd1b5c3ea 100644 |
| --- a/lib/syscall.c |
| +++ b/lib/syscall.c |
| @@ -12,6 +12,7 @@ static int collect_syscall(struct task_struct *target, long *callno, |
| |
| if (!try_get_task_stack(target)) { |
| /* Task has no stack, so the task isn't in a syscall. */ |
| + *sp = *pc = 0; |
| *callno = -1; |
| return 0; |
| } |
| -- |
| 2.12.0 |
| |