fix infoleak in waitid(2)
authorAl Viro <viro@zeniv.linux.org.uk>
Fri, 29 Sep 2017 17:43:15 +0000 (13:43 -0400)
committerBen Hutchings <ben@decadent.org.uk>
Sun, 1 Oct 2017 14:52:09 +0000 (15:52 +0100)
commit30e998fc1726ea8fff9fec49f0e6490d533589e5
treeb54acbca2f14aabb0fe88e59d5056748960f6591
parent361c6bca9c1a788bbd5ba2a1d0e039d143bb1b3f
fix infoleak in waitid(2)

kernel_waitid() can return a PID, an error or 0.  rusage is filled in the first
case and waitid(2) rusage should've been copied out exactly in that case, *not*
whenever kernel_waitid() has not returned an error.  Compat variant shares that
braino; none of kernel_wait4() callers do, so the below ought to fix it.

Reported-and-tested-by: Alexander Potapenko <glider@google.com>
Fixes: ce72a16fa705 ("wait4(2)/waitid(2): separate copying rusage to userland")
Cc: stable@vger.kernel.org # v4.13
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Gbp-Pq: Topic bugfix/all
Gbp-Pq: Name fix-infoleak-in-waitid-2.patch
kernel/exit.c