Commit 467251c6 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'waitid-fix'

Merge waitid() fix from Kees Cook.

I'd have hoped that the unsafe_{get|put}_user() naming would have
avoided these kinds of stupid bugs, but no such luck.

* waitid-fix:
  waitid(): Add missing access_ok() checks
parents ff5abbe7 96ca579a
...@@ -1610,6 +1610,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *, ...@@ -1610,6 +1610,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
if (!infop) if (!infop)
return err; return err;
if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
goto Efault;
user_access_begin(); user_access_begin();
unsafe_put_user(signo, &infop->si_signo, Efault); unsafe_put_user(signo, &infop->si_signo, Efault);
unsafe_put_user(0, &infop->si_errno, Efault); unsafe_put_user(0, &infop->si_errno, Efault);
...@@ -1735,6 +1738,9 @@ COMPAT_SYSCALL_DEFINE5(waitid, ...@@ -1735,6 +1738,9 @@ COMPAT_SYSCALL_DEFINE5(waitid,
if (!infop) if (!infop)
return err; return err;
if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
goto Efault;
user_access_begin(); user_access_begin();
unsafe_put_user(signo, &infop->si_signo, Efault); unsafe_put_user(signo, &infop->si_signo, Efault);
unsafe_put_user(0, &infop->si_errno, Efault); unsafe_put_user(0, &infop->si_errno, Efault);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment