Commit 467251c6 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'waitid-fix' 

Merge waitid() fix from Kees Cook.

I'd have hoped that the unsafe_{get|put}_user() naming would have
avoided these kinds of stupid bugs, but no such luck.

* waitid-fix:
  waitid(): Add missing access_ok() checks
parents ff5abbe7 96ca579a

kernel/exit.c

+6 −0
Original line number Diff line number Diff line
@@ -1610,6 +1610,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *, 
	if (!infop)

		return err;



	if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))

		goto Efault;



	user_access_begin();

	unsafe_put_user(signo, &infop->si_signo, Efault);

	unsafe_put_user(0, &infop->si_errno, Efault);
@@ -1735,6 +1738,9 @@ COMPAT_SYSCALL_DEFINE5(waitid, 
	if (!infop)

		return err;



	if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))

		goto Efault;



	user_access_begin();

	unsafe_put_user(signo, &infop->si_signo, Efault);

	unsafe_put_user(0, &infop->si_errno, Efault);