linux-kernel - Re: [syzbot] [kernel?] KMSAN: kernel-infoleak-after-free in copy_siginfo_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 31 Dec 2023 09:51:27 +0800
From: Edward Adam Davis <eadavis@...com>
To: syzbot+cfc08744435c4cf94a40@...kaller.appspotmail.com
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [kernel?] KMSAN: kernel-infoleak-after-free in copy_siginfo_to_user (2)

please test kernel-infoleak-after-free in copy_siginfo_to_user

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 861deac3b092

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index d8b5e13a2229..8bd346b10c6e 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -1033,7 +1033,7 @@ int ptrace_request(struct task_struct *child, long request,
 {
 	bool seized = child->ptrace & PT_SEIZED;
 	int ret = -EIO;
-	kernel_siginfo_t siginfo, *si;
+	kernel_siginfo_t siginfo, *si, *psiginfo;
 	void __user *datavp = (void __user *) data;
 	unsigned long __user *datalp = datavp;
 	unsigned long flags;
@@ -1061,9 +1061,13 @@ int ptrace_request(struct task_struct *child, long request,
 		break;
 
 	case PTRACE_GETSIGINFO:
-		ret = ptrace_getsiginfo(child, &siginfo);
+		psiginfo = kvmalloc(sizeof(kernel_siginfo_t), GFP_KERNEL);
+		if (!psiginfo)
+			break;
+		ret = ptrace_getsiginfo(child, psiginfo);
 		if (!ret)
-			ret = copy_siginfo_to_user(datavp, &siginfo);
+			ret = copy_siginfo_to_user(datavp, psiginfo);
+		kvfree(psiginfo);
 		break;
 
 	case PTRACE_SETSIGINFO: