From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:49554 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751900AbdJLU2l (ORCPT ); Thu, 12 Oct 2017 16:28:41 -0400 Subject: Patch "waitid(): Add missing access_ok() checks" has been added to the 4.13-stable tree To: keescook@chromium.org, chrissalls5@gmail.com, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, viro@zeniv.linux.org.uk Cc: , From: Date: Thu, 12 Oct 2017 22:28:48 +0200 Message-ID: <1507840128145133@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled waitid(): Add missing access_ok() checks to the 4.13-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: waitid-add-missing-access_ok-checks.patch and it can be found in the queue-4.13 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 96ca579a1ecc943b75beba58bebb0356f6cc4b51 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Mon, 9 Oct 2017 11:36:52 -0700 Subject: waitid(): Add missing access_ok() checks From: Kees Cook commit 96ca579a1ecc943b75beba58bebb0356f6cc4b51 upstream. Adds missing access_ok() checks. CVE-2017-5123 Reported-by: Chris Salls Signed-off-by: Kees Cook Acked-by: Al Viro Fixes: 4c48abe91be0 ("waitid(): switch copyout of siginfo to unsafe_put_user()") Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- kernel/exit.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/kernel/exit.c +++ b/kernel/exit.c @@ -1611,6 +1611,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_ if (!infop) return err; + if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop))) + goto Efault; + user_access_begin(); unsafe_put_user(signo, &infop->si_signo, Efault); unsafe_put_user(0, &infop->si_errno, Efault); @@ -1736,6 +1739,9 @@ COMPAT_SYSCALL_DEFINE5(waitid, if (!infop) return err; + if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop))) + goto Efault; + user_access_begin(); unsafe_put_user(signo, &infop->si_signo, Efault); unsafe_put_user(0, &infop->si_errno, Efault); Patches currently in stable-queue which might be from keescook@chromium.org are queue-4.13/waitid-add-missing-access_ok-checks.patch