Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2017-10-09 11:36:52 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-10-14 15:38:17 +0200
commit3da54587cf4c1be7c26a8ae0b58313828b69638a (patch)
tree55a510f807e814ff0515db2676646273a1192102
parentff04be02de1b371689260ab2e217a93b57ea4364 (diff)
waitid(): Add missing access_ok() checks
commit 96ca579a1ecc943b75beba58bebb0356f6cc4b51 upstream. Adds missing access_ok() checks. CVE-2017-5123 Reported-by: Chris Salls <chrissalls5@gmail.com> Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Al Viro <viro@zeniv.linux.org.uk> Fixes: 4c48abe91be0 ("waitid(): switch copyout of siginfo to unsafe_put_user()") Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--kernel/exit.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/kernel/exit.c b/kernel/exit.c
index 6d31fc5ba50d..135b36985f8a 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1611,6 +1611,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
if (!infop)
return err;
+ if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+ goto Efault;
+
user_access_begin();
unsafe_put_user(signo, &infop->si_signo, Efault);
unsafe_put_user(0, &infop->si_errno, Efault);
@@ -1736,6 +1739,9 @@ COMPAT_SYSCALL_DEFINE5(waitid,
if (!infop)
return err;
+ if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+ goto Efault;
+
user_access_begin();
unsafe_put_user(signo, &infop->si_signo, Efault);
unsafe_put_user(0, &infop->si_errno, Efault);