From: Kees Cook <keescook@chromium.org>
Date: Mon, 9 Oct 2017 18:36:52 +0000 (-0700)
Subject: waitid(): Add missing access_ok() checks
X-Git-Tag: archive/raspbian/4.15.4-1+rpi1~1^2^2^2^2^2~16
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=00296fa590d73b573ff2cded5a8372fec5f04ad0;p=linux.git

waitid(): Add missing access_ok() checks

Adds missing access_ok() checks.

CVE-2017-5123

Reported-by: Chris Salls <chrissalls5@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Fixes: 4c48abe91be0 ("waitid(): switch copyout of siginfo to unsafe_put_user()")
Cc: stable@kernel.org # 4.13
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Gbp-Pq: Topic bugfix/all
Gbp-Pq: Name waitid-Add-missing-access_ok-checks.patch
---

diff --git a/kernel/exit.c b/kernel/exit.c
index 6d31fc5ba50..135b36985f8 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1611,6 +1611,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
 	if (!infop)
 		return err;
 
+	if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+		goto Efault;
+
 	user_access_begin();
 	unsafe_put_user(signo, &infop->si_signo, Efault);
 	unsafe_put_user(0, &infop->si_errno, Efault);
@@ -1736,6 +1739,9 @@ COMPAT_SYSCALL_DEFINE5(waitid,
 	if (!infop)
 		return err;
 
+	if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+		goto Efault;
+
 	user_access_begin();
 	unsafe_put_user(signo, &infop->si_signo, Efault);
 	unsafe_put_user(0, &infop->si_errno, Efault);