diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-04-27 09:33:21 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-04-27 09:33:21 +0200 |
| commit | e947861d0ccbc765af4512a395251e6af6857600 (patch) | |
| tree | e2b8d646f40016e887162bcaf53859edaae15bc9 /kernel/fork.c | |
| parent | 6f1c0268a4871a80c0ec78142eeb1fe0556e898a (diff) | |
| parent | 6a8b55ed4056ea5559ebe4f6a4b247f627870d4c (diff) | |
Merge 5.7-rc3 into tty-next
We need the tty/serial fixes in here too.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel/fork.c')
| -rw-r--r-- | kernel/fork.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/kernel/fork.c b/kernel/fork.c index 4385f3d639f2..8c700f881d92 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2605,6 +2605,14 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs, struct clone_args args; pid_t *kset_tid = kargs->set_tid; + BUILD_BUG_ON(offsetofend(struct clone_args, tls) != + CLONE_ARGS_SIZE_VER0); + BUILD_BUG_ON(offsetofend(struct clone_args, set_tid_size) != + CLONE_ARGS_SIZE_VER1); + BUILD_BUG_ON(offsetofend(struct clone_args, cgroup) != + CLONE_ARGS_SIZE_VER2); + BUILD_BUG_ON(sizeof(struct clone_args) != CLONE_ARGS_SIZE_VER2); + if (unlikely(usize > PAGE_SIZE)) return -E2BIG; if (unlikely(usize < CLONE_ARGS_SIZE_VER0)) @@ -2631,7 +2639,8 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs, !valid_signal(args.exit_signal))) return -EINVAL; - if ((args.flags & CLONE_INTO_CGROUP) && args.cgroup < 0) + if ((args.flags & CLONE_INTO_CGROUP) && + (args.cgroup > INT_MAX || usize < CLONE_ARGS_SIZE_VER2)) return -EINVAL; *kargs = (struct kernel_clone_args){ |