Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 26 Sep 2018 17:17:25 +0200
Message-Id: <20180926151725.63120-1-glider@google.com>
Mime-Version: 1.0
Subject: [PATCH] ptrace: zero out siginfo_t in ptrace_peek_siginfo()
From:   Alexander Potapenko <glider@google.com>
To:     oleg@redhat.com
Cc:     linux-kernel@vger.kernel.org, dvyukov@google.com,
        andreyknvl@google.com, w@1wt.eu, avagin@openvz.org
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

KMSAN reported the following infoleak:

==================================================================
BUG: KMSAN: kernel-infoleak in _copy_to_user+0x15d/0x1f0
...
Call Trace:
 __dump_stack lib/dump_stack.c:77
 dump_stack+0x2f5/0x430 lib/dump_stack.c:113
 kmsan_report+0x183/0x2b0 mm/kmsan/kmsan.c:917
 kmsan_internal_check_memory+0x17e/0x1f0 mm/kmsan/kmsan.c:981
 kmsan_copy_to_user+0x79/0xc0 mm/kmsan/kmsan_hooks.c:482
 _copy_to_user+0x15d/0x1f0 lib/usercopy.c:31
 copy_to_user ./include/linux/uaccess.h:183
 copy_siginfo_to_user+0x81/0x130 kernel/signal.c:2897
 ptrace_peek_siginfo kernel/ptrace.c:741
 ptrace_request+0x2278/0x2680 kernel/ptrace.c:912
 arch_ptrace+0xbdd/0x11a0 arch/x86/kernel/ptrace.c:877
 __do_sys_ptrace kernel/ptrace.c:1145
 __se_sys_ptrace+0x422/0x920 kernel/ptrace.c:1110
 __x64_sys_ptrace+0x56/0x70 kernel/ptrace.c:1110
 do_syscall_64+0xb8/0x100 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x63/0xe7 arch/x86/entry/entry_64.S:240
...
Local variable description: ----info.i@ptrace_request
Variable was created at:
 ptrace_peek_siginfo kernel/ptrace.c:712
 ptrace_request+0xdf/0x2680 kernel/ptrace.c:912
 arch_ptrace+0xbdd/0x11a0 arch/x86/kernel/ptrace.c:877

Bytes 16-127 of 128 are uninitialized
Memory access starts at ffff88007af6fc90
==================================================================

when calling ptrace(PTRACE_PEEKSIGINFO) for a traceable child process
with args = {-1, 0, 1}.

Initialize the |info| structure to avoid leaking stack data.

Signed-off-by: Alexander Potapenko <glider@google.com>
Reported-by: syzbot+69c3bd9869b32e394c48@syzkaller.appspotmail.com
Fixes: 84c751bd4aebb ("ptrace: add ability to retrieve signals without
removing from a queue (v4)")
Cc: Andrey Vagin <avagin@openvz.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Willy Tarreau <w@1wt.eu>
---
 kernel/ptrace.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 21fec73d45d4..92c3855c2b9c 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -712,6 +712,7 @@ static int ptrace_peek_siginfo(struct task_struct *child,
 		siginfo_t info;
 		s32 off = arg.off + i;
 
+		memset(&info, 0, sizeof(info));
 		spin_lock_irq(&child->sighand->siglock);
 		list_for_each_entry(q, &pending->list, list) {
 			if (!off--) {
-- 
2.19.0.605.g01d371f741-goog