Mathias Krause 6891c4509c posix-timers: Fix stack info leak in timer_create() ... If userland creates a timer without specifying a sigevent info, we'll create one ourself, using a stack local variable. Particularly will we use the timer ID as sival_int. But as sigev_value is a union containing a pointer and an int, that assignment will only partially initialize sigev_value on systems where the size of a pointer is bigger than the size of an int. On such systems we'll copy the uninitialized stack bytes from the timer_create() call to userland when the timer actually fires and we're going to deliver the signal. Initialize sigev_value with 0 to plug the stack info leak. Found in the PaX patch, written by the PaX Team. Fixes: 5a9fa73072 ("posix-timers: kill ->it_sigev_signo and...") Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Brad Spengler <spender@grsecurity.net> Cc: PaX Team <pageexec@freemail.hu> Cc: <stable@vger.kernel.org> # v2.6.28+ Link: http://lkml.kernel.org/r/1412456799-32339-1-git-send-email-minipli@googlemail.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de>		2014-10-25 10:43:15 +02:00
..
bpf	bpf: add search pruning optimization to verifier	2014-10-01 21:30:33 -04:00
configs	x86: Add "make tinyconfig" to configure the tiniest possible kernel	2014-08-08 16:30:24 -07:00
debug	kdb: replace strnicmp with strncasecmp	2014-10-14 02:18:25 +02:00
events	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
gcov	ARM: 8153/1: Enable gcov support on the ARM architecture	2014-09-26 14:39:57 +01:00
irq	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
locking	Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-10-13 15:51:40 +02:00
power	Merge branch 'pm-domains'	2014-10-07 01:18:12 +02:00
printk	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
rcu	rcu: Eliminate deadlock between CPU hotplug and expedited grace periods	2014-09-18 16:22:27 -07:00
sched	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
time	posix-timers: Fix stack info leak in timer_create()	2014-10-25 10:43:15 +02:00
trace	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-10-13 16:23:15 +02:00
.gitignore
acct.c	acct: eliminate compile warning	2014-10-09 22:26:04 -04:00
async.c	kernel/async.c: switch to pr_foo()	2014-10-09 22:26:04 -04:00
audit_tree.c	audit: rename audit_log_remove_rule to disambiguate for trees	2014-10-10 15:30:25 -04:00
audit_watch.c	audit: invalid op= values for rules	2014-09-23 16:37:53 -04:00
audit.c	Merge git://git.infradead.org/users/eparis/audit	2014-10-19 16:25:56 -07:00
audit.h	audit: reduce scope of audit_log_fcaps	2014-09-23 16:37:51 -04:00
auditfilter.c	Merge git://git.infradead.org/users/eparis/audit	2014-10-19 16:25:56 -07:00
auditsc.c	Merge git://git.infradead.org/users/eparis/audit	2014-10-19 16:25:56 -07:00
backtracetest.c
bounds.c	page-cgroup: get rid of NR_PCG_FLAGS	2014-08-08 15:57:18 -07:00
capability.c	CAPABILITIES: remove undefined caps from all processes	2014-07-24 21:53:47 +10:00
cgroup_freezer.c
cgroup.c	Merge branch 'for-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-10 07:26:02 -04:00
compat.c	compat: nanosleep: Clarify error handling	2014-09-06 12:58:18 +02:00
configs.c
context_tracking.c
cpu_pm.c
cpu.c	rcu: Eliminate deadlock between CPU hotplug and expedited grace periods	2014-09-18 16:22:27 -07:00
cpuset.c	Merge branch 'for-3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2014-10-10 07:24:40 -04:00
crash_dump.c	crash_dump: Make is_kdump_kernel() accessible from modules	2014-08-25 15:42:19 -07:00
cred.c
delayacct.c	delayacct: Remove braindamaged type conversions	2014-07-23 10:18:06 -07:00
dma.c
elfcore.c
exec_domain.c
exit.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-10-13 16:23:15 +02:00
extable.c
fork.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-10-13 16:23:15 +02:00
freezer.c
futex_compat.c
futex.c	futex: Ensure get_futex_key_refs() always implies a barrier	2014-10-18 09:28:51 -07:00
groups.c
hung_task.c
irq_work.c	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
jump_label.c
kallsyms.c	kernel/kallsyms.c: use __seq_open_private()	2014-10-14 02:18:16 +02:00
kcmp.c	kcmp: fix standard comparison bug	2014-09-10 15:42:12 -07:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kexec.c	kexec: remove the unused function parameter	2014-10-14 02:18:21 +02:00
kmod.c
kprobes.c	kprobes: Skip kretprobe hit in NMI context to avoid deadlock	2014-08-08 10:38:04 +02:00
ksysfs.c
kthread.c	kernel/kthread.c: partial revert of 81c98869fa ("kthread: ensure locality of task_struct allocations")	2014-10-09 22:25:51 -04:00
latencytop.c
Makefile	bin2c: move bin2c in scripts/basic	2014-08-08 15:57:32 -07:00
module_signing.c
module-internal.h
module.c	A single panic fix for a rare race, stable CC'd.	2014-10-18 10:24:26 -07:00
notifier.c
nsproxy.c	namespaces: Use task_lock and not rcu to protect nsproxy	2014-07-29 18:08:50 -07:00
padata.c
panic.c	panic: add TAINT_SOFTLOCKUP	2014-08-08 15:57:24 -07:00
params.c	kernel/param: consolidate __{start,stop}___param[] in <linux/moduleparam.h>	2014-10-14 02:18:28 +02:00
pid_namespace.c
pid.c
profile.c
ptrace.c
range.c
reboot.c	kernel: add support for kernel restart handler call chain	2014-09-26 00:00:06 -07:00
relay.c
res_counter.c
resource.c	x86: optimize resource lookups for ioremap	2014-10-14 02:18:22 +02:00
seccomp.c	Merge branch 'x86-seccomp-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-10-14 02:27:06 +02:00
signal.c	Merge branch 'signal-cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/misc	2014-08-09 09:58:12 -07:00
smp.c	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
smpboot.c
smpboot.h
softirq.c	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
stacktrace.c
stop_machine.c
sys_ni.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-10-08 21:40:54 -04:00
sys.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-10-13 16:23:15 +02:00
sysctl_binary.c	dmaengine-3.17	2014-10-07 20:39:25 -04:00
sysctl.c	Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-10-13 15:44:12 +02:00
system_certificates.S
system_keyring.c
task_work.c
taskstats.c	scheduler: Replace __get_cpu_var with this_cpu_ptr	2014-08-26 13:45:45 -04:00
test_kprobes.c	kernel/test_kprobes.c: use current logging functions	2014-08-08 15:57:18 -07:00
torture.c	torture: Address race in module cleanup	2014-09-16 13:41:06 -07:00
tracepoint.c
tsacct.c	sched: Make task->start_time nanoseconds based	2014-07-23 10:18:05 -07:00
uid16.c
up.c
user_namespace.c	proc: constify seq_operations	2014-08-08 15:57:22 -07:00
user-return-notifier.c	scheduler: Replace __get_cpu_var with this_cpu_ptr	2014-08-26 13:45:45 -04:00
user.c
utsname_sysctl.c
utsname.c	namespaces: Use task_lock and not rcu to protect nsproxy	2014-07-29 18:08:50 -07:00
watchdog.c	Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2014-10-15 07:48:18 +02:00
workqueue_internal.h
workqueue.c	workqueue: Use cond_resched_rcu_qs macro	2014-10-06 05:58:26 -07:00