[PATCH v2] linux: Enforce zero fill of siginfo_t

[Adhemerval Zanella Netto]

On 20/01/26 10:26, Andreas Schwab wrote:
> On Jan 20 2026, Adhemerval Zanella wrote:
> 
>> +    siginfo_t info;
>> +    /* The glibc siginfo struct is larger than the kABI one, and the kernel
>> +       enforces that for an unknown si_code, all the extra bytes should be 0.  */
> 
> Why does the kernel even look at anything beyond the struct size?  That
> looks like a kernel bug.
> 

kernel/signal.c

3508 static int post_copy_siginfo_from_user(kernel_siginfo_t *info,
3509                                        const siginfo_t __user *from)
3510 {
3511         if (unlikely(!known_siginfo_layout(info->si_signo, info->si_code))) {
3512                 char __user *expansion = si_expansion(from);
3513                 char buf[SI_EXPANSION_SIZE];
3514                 int i;
3515                 /*
3516                  * An unknown si_code might need more than
3517                  * sizeof(struct kernel_siginfo) bytes.  Verify all of the
3518                  * extra bytes are 0.  This guarantees copy_siginfo_to_user
3519                  * will return this data to userspace exactly.
3520                  */
3521                 if (copy_from_user(&buf, expansion, SI_EXPANSION_SIZE))
3522                         return -EFAULT;
3523                 for (i = 0; i < SI_EXPANSION_SIZE; i++) {
3524                         if (buf[i] != 0)
3525                                 return -E2BIG;
3526                 }
3527         }
3528         return 0;
3529 }

We explicit use an invalid si_code on the test.