linux-kernel - Re: sigaction's ucontext_t with incorrect stack reference when SA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 24 Jan 2007 08:44:43 +0100
From:	Xavier Roche <roche+kml2@...lead.com>
To:	Nicholas Miell <nmiell@...cast.net>
CC:	Linux Kernel <linux-kernel@...r.kernel.org>
Subject: Re: sigaction's ucontext_t with incorrect stack reference when	SA_SIGINFO
 is being used ?

Nicholas Miell wrote:
> so if uc_stack doesn't point to the stack in use immediately prior to
> signal generation, this is a bug.

Looking at arch/i386/kernel/signal.c (and others) inside
setup_rt_frame(), the problem is pretty obvious:

err |= __put_user(current->sas_ss_sp, &frame_user->uc.uc_stack.ss_sp);
err |= __put_user(sas_ss_flags(regs->esp),
	&frame->uc.uc_stack.ss_flags);
err |= __put_user(current->sas_ss_size, &frame_user->uc.uc_stack.ss_size);

And of course, the ss_sp is NULL when no alternative stack is used.
Seems definitively a bug.

However, my reading of include/linux/sched.h and thread_info.h did not
enlighten me on the way to get the original thread's stack base and size.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/