Emese Revfy  committed b9e146d

kernel/signal.c: stop info leak via the tkill and the tgkill syscalls

This fixes a kernel memory contents leak via the tkill and tgkill syscalls
for compat processes.

This is visible in the siginfo_t->_sifields._rt.si_sigval.sival_ptr field
when handling signals delivered from tkill.

The place of the infoleak:

int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr);

Signed-off-by: Emese Revfy <>
Reviewed-by: PaX Team <>
Signed-off-by: Kees Cook <>
Cc: Al Viro <>
Cc: Oleg Nesterov <>
Cc: "Eric W. Biederman" <>
Cc: Serge Hallyn <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>

  • Participants
  • Parent commits d72515b

Comments (0)

Files changed (1)

File kernel/signal.c

 static int do_tkill(pid_t tgid, pid_t pid, int sig)
-	struct siginfo info;
+	struct siginfo info = {};
 	info.si_signo = sig;
 	info.si_errno = 0;