signal: Guard against negative signal numbers in copy_siginfo_from_user32
authorEric W. Biederman <ebiederm@xmission.com>
Thu, 11 Oct 2018 01:29:44 +0000 (20:29 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 13 Nov 2018 19:15:07 +0000 (11:15 -0800)
commit51f62e827191f4ba02c2a001b9e6f25605bfa649
tree032c83b2cee55ae06c3d0c431c66a5e4be608f4d
parenteb7f3c513d1c898abdc66809406d62ce9ec7c50d
signal: Guard against negative signal numbers in copy_siginfo_from_user32

commit a36700589b85443e28170be59fa11c8a104130a5 upstream.

While fixing an out of bounds array access in known_siginfo_layout
reported by the kernel test robot it became apparent that the same bug
exists in siginfo_layout and affects copy_siginfo_from_user32.

The straight forward fix that makes guards against making this mistake
in the future and should keep the code size small is to just take an
unsigned signal number instead of a signed signal number, as I did to
fix known_siginfo_layout.

Cc: stable@vger.kernel.org
Fixes: cc731525f26a ("signal: Remove kernel interal si_code magic")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
include/linux/signal.h
kernel/signal.c