diff mbox

[3.19.y-ckt,stable] Patch "MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp'" has been added to the 3.19.y-ckt tree

Message ID 1458157318-7654-1-git-send-email-kamal@canonical.com
State New
Headers show

Commit Message

Kamal Mostafa March 16, 2016, 7:41 p.m. UTC 
This is a note to let you know that I have just added a patch titled

    MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp'

to the linux-3.19.y-queue branch of the 3.19.y-ckt extended stable tree 
which can be found at:

    http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.19.y-queue

This patch is scheduled to be released in version 3.19.8-ckt17.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.19.y-ckt tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

---8<------------------------------------------------------------

From 6bd48394ff07bfdb973c9187b789a464d4ccb8e2 Mon Sep 17 00:00:00 2001
From: "Maciej W. Rozycki" <macro@imgtec.com>
Date: Fri, 4 Mar 2016 01:42:49 +0000
Subject: MIPS: traps: Fix SIGFPE information leak from `do_ov' and
 `do_trap_or_bp'

commit e723e3f7f9591b79e8c56b3d7c5a204a9c571b55 upstream.

Avoid sending a partially initialised `siginfo_t' structure along SIGFPE
signals issued from `do_ov' and `do_trap_or_bp', leading to information
leaking from the kernel stack.

Signed-off-by: Maciej W. Rozycki <macro@imgtec.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/mips/kernel/traps.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

--
2.7.0
diff mbox

Patch

diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 3e0e61f..7dd15e9 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -692,15 +692,15 @@  static int simulate_sync(struct pt_regs *regs, unsigned int opcode)
 asmlinkage void do_ov(struct pt_regs *regs)
 {
 	enum ctx_state prev_state;
-	siginfo_t info;
+	siginfo_t info = {
+		.si_signo = SIGFPE,
+		.si_code = FPE_INTOVF,
+		.si_addr = (void __user *)regs->cp0_epc,
+	};

 	prev_state = exception_enter();
 	die_if_kernel("Integer overflow", regs);

-	info.si_code = FPE_INTOVF;
-	info.si_signo = SIGFPE;
-	info.si_errno = 0;
-	info.si_addr = (void __user *) regs->cp0_epc;
 	force_sig_info(SIGFPE, &info, current);
 	exception_exit(prev_state);
 }
@@ -847,7 +847,7 @@  out:
 static void do_trap_or_bp(struct pt_regs *regs, unsigned int code,
 	const char *str)
 {
-	siginfo_t info;
+	siginfo_t info = { 0 };
 	char b[40];

 #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP
@@ -875,7 +875,6 @@  static void do_trap_or_bp(struct pt_regs *regs, unsigned int code,
 		else
 			info.si_code = FPE_INTOVF;
 		info.si_signo = SIGFPE;
-		info.si_errno = 0;
 		info.si_addr = (void __user *) regs->cp0_epc;
 		force_sig_info(SIGFPE, &info, current);
 		break;