48 lines
1.4 KiB
Diff
48 lines
1.4 KiB
Diff
From: Kees Cook <keescook@chromium.org>
|
|
Date: Mon, 9 Oct 2017 11:36:52 -0700
|
|
Subject: waitid(): Add missing access_ok() checks
|
|
Origin: https://git.kernel.org/linus/96ca579a1ecc943b75beba58bebb0356f6cc4b51
|
|
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-5123
|
|
|
|
Adds missing access_ok() checks.
|
|
|
|
CVE-2017-5123
|
|
|
|
Reported-by: Chris Salls <chrissalls5@gmail.com>
|
|
Signed-off-by: Kees Cook <keescook@chromium.org>
|
|
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
|
|
Fixes: 4c48abe91be0 ("waitid(): switch copyout of siginfo to unsafe_put_user()")
|
|
Cc: stable@kernel.org # 4.13
|
|
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
---
|
|
kernel/exit.c | 6 ++++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
diff --git a/kernel/exit.c b/kernel/exit.c
|
|
index f2cd53e92147..cf28528842bc 100644
|
|
--- a/kernel/exit.c
|
|
+++ b/kernel/exit.c
|
|
@@ -1610,6 +1610,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
|
|
if (!infop)
|
|
return err;
|
|
|
|
+ if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
|
|
+ goto Efault;
|
|
+
|
|
user_access_begin();
|
|
unsafe_put_user(signo, &infop->si_signo, Efault);
|
|
unsafe_put_user(0, &infop->si_errno, Efault);
|
|
@@ -1735,6 +1738,9 @@ COMPAT_SYSCALL_DEFINE5(waitid,
|
|
if (!infop)
|
|
return err;
|
|
|
|
+ if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
|
|
+ goto Efault;
|
|
+
|
|
user_access_begin();
|
|
unsafe_put_user(signo, &infop->si_signo, Efault);
|
|
unsafe_put_user(0, &infop->si_errno, Efault);
|
|
--
|
|
2.15.0.rc0
|
|
|