]> git.baikalelectronics.ru Git - kernel.git/commit
signal: Guard against negative signal numbers in copy_siginfo_from_user32
authorEric W. Biederman <ebiederm@xmission.com>
Thu, 11 Oct 2018 01:29:44 +0000 (20:29 -0500)
committerEric W. Biederman <ebiederm@xmission.com>
Thu, 11 Oct 2018 01:34:14 +0000 (20:34 -0500)
commitb89f50c78c00e9494cc31d5231f0db65210aa5f7
treee845a14e4499d6bd3bbab6ac4a1c6b84e2b60f96
parenteaf04cff114aa877b8c01aa4adf8d9e8e041634c
signal: Guard against negative signal numbers in copy_siginfo_from_user32

While fixing an out of bounds array access in known_siginfo_layout
reported by the kernel test robot it became apparent that the same bug
exists in siginfo_layout and affects copy_siginfo_from_user32.

The straight forward fix that makes guards against making this mistake
in the future and should keep the code size small is to just take an
unsigned signal number instead of a signed signal number, as I did to
fix known_siginfo_layout.

Cc: stable@vger.kernel.org
Fixes: 31000cb0a490 ("signal: Remove kernel interal si_code magic")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
include/linux/signal.h
kernel/signal.c