summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2017-10-12 08:36:47 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2017-10-12 08:36:47 -0700
commit467251c69b1b39df78638d0d0cc60cf4d1d639a8 (patch)
treee4d9d8ef28a71678d900d4c98f83ab01c7599ae4
parentff5abbe799e29099695cb8b5b2f198dd8b8bdf26 (diff)
parent96ca579a1ecc943b75beba58bebb0356f6cc4b51 (diff)
downloadlinux-467251c69b1b39df78638d0d0cc60cf4d1d639a8.tar.bz2
Merge branch 'waitid-fix'
Merge waitid() fix from Kees Cook. I'd have hoped that the unsafe_{get|put}_user() naming would have avoided these kinds of stupid bugs, but no such luck. * waitid-fix: waitid(): Add missing access_ok() checks
-rw-r--r--kernel/exit.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/kernel/exit.c b/kernel/exit.c
index f2cd53e92147..cf28528842bc 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1610,6 +1610,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
if (!infop)
return err;
+ if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+ goto Efault;
+
user_access_begin();
unsafe_put_user(signo, &infop->si_signo, Efault);
unsafe_put_user(0, &infop->si_errno, Efault);
@@ -1735,6 +1738,9 @@ COMPAT_SYSCALL_DEFINE5(waitid,
if (!infop)
return err;
+ if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+ goto Efault;
+
user_access_begin();
unsafe_put_user(signo, &infop->si_signo, Efault);
unsafe_put_user(0, &infop->si_errno, Efault);