)]}'
{
  "commit": "d8ed9cf7cc64d98031a7b8363aecde8b88b09d79",
  "tree": "5e5c5d2b5bde7f2c03f82ceb9ecde21f74785b39",
  "parents": [
    "60ac27ff094919f05da9687908c90376ca399b03"
  ],
  "author": {
    "name": "Kees Cook",
    "email": "keescook@chromium.org",
    "time": "Wed Mar 13 14:59:33 2013 -0700"
  },
  "committer": {
    "name": "Akhila Musunuri",
    "email": "makhila@codeaurora.org",
    "time": "Tue May 07 17:22:03 2013 +0530"
  },
  "message": "signal: always clear sa_restorer on execve\n\nWhen the new signal handlers are set up, the location of sa_restorer is\nnot cleared, leaking a parent process\u0027s address space location to\nchildren.  This allows for a potential bypass of the parent\u0027s ASLR by\nexamining the sa_restorer value returned when calling sigaction().\n\nBased on what should be considered \"secret\" about addresses, it only\nmatters across the exec not the fork (since the VMAs haven\u0027t changed\nuntil the exec).  But since exec sets SIG_DFL and keeps sa_restorer,\nthis is where it should be fixed.\n\nGiven the few uses of sa_restorer, a \"set\" function was not written\nsince this would be the only use.  Instead, we use\n__ARCH_HAS_SA_RESTORER, as already done in other places.\n\nExample of the leak before applying this patch:\n\n  $ cat /proc/$$/maps\n  ...\n  7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so\n  ...\n  $ ./leak\n  ...\n  7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so\n  ...\n  1 0 (nil) 0x7fb9f30b94a0\n  2 4000000 (nil) 0x7f278bcaa4a0\n  3 4000000 (nil) 0x7f278bcaa4a0\n  4 0 (nil) 0x7fb9f30b94a0\n  ...\n\n[akpm@linux-foundation.org: use SA_RESTORER for backportability]\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\nReported-by: Emese Revfy \u003cre.emese@gmail.com\u003e\nCc: Emese Revfy \u003cre.emese@gmail.com\u003e\nCc: PaX Team \u003cpageexec@freemail.hu\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: \"Eric W. Biederman\" \u003cebiederm@xmission.com\u003e\nCc: Serge Hallyn \u003cserge.hallyn@canonical.com\u003e\nCc: Julien Tinnes \u003cjln@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n\nChange-Id: I7ae396ee90c2339c86f7b773d15f5571f8fd54c5\nSigned-off-by: Akhila Musunuri \u003cmakhila@codeaurora.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "17afcaf582d07a5bb8abf843a44d1f593403e473",
      "old_mode": 33188,
      "old_path": "kernel/signal.c",
      "new_id": "7a06651e04bcac9845c65a87a7eabd1b65e93534",
      "new_mode": 33188,
      "new_path": "kernel/signal.c"
    }
  ]
}