Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 96ca579a authored by Kees Cook's avatar Kees Cook Committed by Linus Torvalds
Browse files

waitid(): Add missing access_ok() checks 



Adds missing access_ok() checks.

CVE-2017-5123

Reported-by: default avatarChris Salls <chrissalls5@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Fixes: 4c48abe9 ("waitid(): switch copyout of siginfo to unsafe_put_user()")
Cc: stable@kernel.org # 4.13
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent ff33952e

kernel/exit.c

+6 −0
Original line number Diff line number Diff line
@@ -1610,6 +1610,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *, 
	if (!infop)

		return err;



	if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))

		goto Efault;



	user_access_begin();

	unsafe_put_user(signo, &infop->si_signo, Efault);

	unsafe_put_user(0, &infop->si_errno, Efault);
@@ -1735,6 +1738,9 @@ COMPAT_SYSCALL_DEFINE5(waitid, 
	if (!infop)

		return err;



	if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))

		goto Efault;



	user_access_begin();

	unsafe_put_user(signo, &infop->si_signo, Efault);

	unsafe_put_user(0, &infop->si_errno, Efault);