Re: [PATCH] lib/syscall: Clear return values when no stack

[Andy Lutomirski]

On Thu, Mar 23, 2017 at 3:46 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote:
> Commit aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()")
> added logic to handle a process stack not existing, but left sp and pc
> uninitialized, which can be later reported via /proc/$pid/syscall for zombie
> processes, potentially exposing kernel memory to userspace.
>
> Zombie /proc/$pid/syscall before:
> -1 0xffffffff9a060100 0xffff92f42d6ad900
>
> Zombie /proc/$pid/syscall after:
> -1 0x0 0x0
>
> Reported-by: Robert ÅwiÄcki <robert@xxxxxxxxxxx>
> Fixes: aa1f1a639621 ("lib/syscall: Pin the task stack in collect_syscall()")
> Cc: stable@xxxxxxxxxxxxxxx # v4.9+
> Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>

Whoops!

Reviewed-by: Andy Lutomirski <luto@xxxxxxxxxx>