redonkable
/
remarkable-linux
1
0
Fork 0
Code Releases Activity

Merge branch 'waitid-fix' 

Merge waitid() fix from Kees Cook.

I'd have hoped that the unsafe_{get|put}_user() naming would have
avoided these kinds of stupid bugs, but no such luck.

* waitid-fix:
  waitid(): Add missing access_ok() checks
zero-colors
Linus Torvalds 2017-10-12 08:36:47 -07:00
parent ff5abbe799 96ca579a1e
commit 467251c69b
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
kernel/exit.c
View File

@ -1610,6 +1610,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
if (!infop)
return err;
if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
goto Efault;
user_access_begin();
unsafe_put_user(signo, &infop->si_signo, Efault);
unsafe_put_user(0, &infop->si_errno, Efault);
@ -1735,6 +1738,9 @@ COMPAT_SYSCALL_DEFINE5(waitid,
if (!infop)
return err;
if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
goto Efault;
user_access_begin();
unsafe_put_user(signo, &infop->si_signo, Efault);
unsafe_put_user(0, &infop->si_errno, Efault);