signal: Guard against negative signal numbers in copy_siginfo_from_user32

While fixing an out of bounds array access in known_siginfo_layout
reported by the kernel test robot it became apparent that the same bug
exists in siginfo_layout and affects copy_siginfo_from_user32.

The straight forward fix that makes guards against making this mistake
in the future and should keep the code size small is to just take an
unsigned signal number instead of a signed signal number, as I did to
fix known_siginfo_layout.

Cc: stable@vger.kernel.org
Fixes: cc731525f26a ("signal: Remove kernel interal si_code magic")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

diff --git a/include/linux/signal.h b/include/linux/signal.h
index 706a499d1eb1d36f4afa33f4286c41f80e2601e3..200ed96a05afea6b72781960fd11e2f4a0b62217 100644 (file)
--- a/include/linux/signal.h
+++ b/include/linux/signal.h
@@ -40,7 +40,7 @@ enum siginfo_layout {
        SIL_SYS,
 };
 
-enum siginfo_layout siginfo_layout(int sig, int si_code);
+enum siginfo_layout siginfo_layout(unsigned sig, int si_code);
 
 /*
  * Define some primitives to manipulate sigset_t.

diff --git a/kernel/signal.c b/kernel/signal.c
index 5f5bf374512b889ad360e2e0d59a061edca818ed..4fd431ce4f91e101f3d75d83cf9284407157d16a 100644 (file)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2879,7 +2879,7 @@ static bool known_siginfo_layout(unsigned sig, int si_code)
        return false;
 }
 
-enum siginfo_layout siginfo_layout(int sig, int si_code)
+enum siginfo_layout siginfo_layout(unsigned sig, int si_code)
 {
        enum siginfo_layout layout = SIL_KILL;
        if ((si_code > SI_USER) && (si_code < SI_KERNEL)) {