Commit 99637e42 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull waitid fix from Al Viro:
 "Fix infoleak in waitid()"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  fix infoleak in waitid(2)
parents 5ba88cd6 6c85501f
...@@ -1600,12 +1600,10 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *, ...@@ -1600,12 +1600,10 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
struct waitid_info info = {.status = 0}; struct waitid_info info = {.status = 0};
long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL); long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL);
int signo = 0; int signo = 0;
if (err > 0) { if (err > 0) {
signo = SIGCHLD; signo = SIGCHLD;
err = 0; err = 0;
}
if (!err) {
if (ru && copy_to_user(ru, &r, sizeof(struct rusage))) if (ru && copy_to_user(ru, &r, sizeof(struct rusage)))
return -EFAULT; return -EFAULT;
} }
...@@ -1723,9 +1721,7 @@ COMPAT_SYSCALL_DEFINE5(waitid, ...@@ -1723,9 +1721,7 @@ COMPAT_SYSCALL_DEFINE5(waitid,
if (err > 0) { if (err > 0) {
signo = SIGCHLD; signo = SIGCHLD;
err = 0; err = 0;
} if (uru) {
if (!err && uru) {
/* kernel_waitid() overwrites everything in ru */ /* kernel_waitid() overwrites everything in ru */
if (COMPAT_USE_64BIT_TIME) if (COMPAT_USE_64BIT_TIME)
err = copy_to_user(uru, &ru, sizeof(ru)); err = copy_to_user(uru, &ru, sizeof(ru));
...@@ -1734,6 +1730,7 @@ COMPAT_SYSCALL_DEFINE5(waitid, ...@@ -1734,6 +1730,7 @@ COMPAT_SYSCALL_DEFINE5(waitid,
if (err) if (err)
return -EFAULT; return -EFAULT;
} }
}
if (!infop) if (!infop)
return err; return err;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment