waitid(): Add missing access_ok() checks

Adds missing access_ok() checks. CVE-2017-5123 Reported-by: Chris Salls <[email protected]> Signed-off-by: Kees Cook <[email protected]> Acked-by: Al Viro <[email protected]> Fixes: 4c48abe ("waitid(): switch copyout of siginfo to unsafe_put_user()") Cc: [email protected] # 4.13 Signed-off-by: Linus Torvalds <[email protected]>
ChenQi1989 · Oct 10, 2017 · 96ca579 · 96ca579
1 parent ff33952
commit 96ca579
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/kernel/exit.c b/kernel/exit.c
@@ -1610,6 +1610,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
 	if (!infop)
 		return err;
 
+	if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+		goto Efault;
+
 	user_access_begin();
 	unsafe_put_user(signo, &infop->si_signo, Efault);
 	unsafe_put_user(0, &infop->si_errno, Efault);
@@ -1735,6 +1738,9 @@ COMPAT_SYSCALL_DEFINE5(waitid,
 	if (!infop)
 		return err;
 
+	if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+		goto Efault;
+
 	user_access_begin();
 	unsafe_put_user(signo, &infop->si_signo, Efault);
 	unsafe_put_user(0, &infop->si_errno, Efault);