Re: [kernel-hardening] [PATCH v2 26/30] fork: Provide usercopy whitelisting for task_struct

From: Rik van Riel
Date: Wed Aug 30 2017 - 14:55:11 EST


On Mon, 2017-08-28 at 14:35 -0700, Kees Cook wrote:
> While the blocked and saved_sigmask fields of task_struct are copied
> to
> userspace (via sigmask_to_save() and setup_rt_frame()), it is always
> copied with a static length (i.e. sizeof(sigset_t)).
>
> The only portion of task_struct that is potentially dynamically sized
> and
> may be copied to userspace is in the architecture-specific
> thread_struct
> at the end of task_struct.
>
Acked-by: Rik van Riel <riel@xxxxxxxxxx>

--
All rights reversed

Attachment: signature.asc
Description: This is a digitally signed message part