diff options
| author | Kees Cook <[email protected]> | 2017-10-09 11:36:52 -0700 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2017-10-09 17:03:31 -0700 |
| commit | 96ca579a1ecc943b75beba58bebb0356f6cc4b51 (patch) | |
| tree | 604f625619b03abbd872e5acc69a85e1b30b80bc | |
| parent | ff33952e4d235efa98ce8a43416c19ddc16fb4fa (diff) | |
waitid(): Add missing access_ok() checks
Adds missing access_ok() checks.
CVE-2017-5123
Reported-by: Chris Salls <[email protected]>
Signed-off-by: Kees Cook <[email protected]>
Acked-by: Al Viro <[email protected]>
Fixes: 4c48abe91be0 ("waitid(): switch copyout of siginfo to unsafe_put_user()")
Cc: [email protected] # 4.13
Signed-off-by: Linus Torvalds <[email protected]>
| -rw-r--r-- | kernel/exit.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/kernel/exit.c b/kernel/exit.c index f2cd53e92147..cf28528842bc 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -1610,6 +1610,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *, if (!infop) return err; + if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop))) + goto Efault; + user_access_begin(); unsafe_put_user(signo, &infop->si_signo, Efault); unsafe_put_user(0, &infop->si_errno, Efault); @@ -1735,6 +1738,9 @@ COMPAT_SYSCALL_DEFINE5(waitid, if (!infop) return err; + if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop))) + goto Efault; + user_access_begin(); unsafe_put_user(signo, &infop->si_signo, Efault); unsafe_put_user(0, &infop->si_errno, Efault); |