From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752369AbdJTOgK (ORCPT ); Fri, 20 Oct 2017 10:36:10 -0400 Received: from mail-pf0-f195.google.com ([209.85.192.195]:43136 "EHLO mail-pf0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752289AbdJTOgI (ORCPT ); Fri, 20 Oct 2017 10:36:08 -0400 X-Google-Smtp-Source: ABhQp+Q/7y4mBTzIsOVAmbnCnj7CEXRCGvB9/3Pr++qEg2FGYdU1zHB2PlH1+ZhkK9dWsCET0DehNw== Date: Fri, 20 Oct 2017 07:36:05 -0700 From: Kees Cook To: Linus Torvalds Cc: Al Viro , linux-kernel@vger.kernel.org, David Daney Subject: [PATCH] waitid(): Avoid unbalanced user_access_end() on access_ok() error Message-ID: <20171020143605.GA59685@beast> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org As pointed out by Linus and David, the earlier waitid() fix resulted in a (currently harmless) unbalanced user_access_end() call. This fixes it to just directly return EFAULT on access_ok() failure. Fixes: 96ca579a1ecc ("waitid(): Add missing access_ok() checks") Cc: Al Viro Cc: David Daney Signed-off-by: Kees Cook --- This seems best to get fixed up now (in the same release where it was introduced) before it tries to bite us at some later time. --- kernel/exit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/exit.c b/kernel/exit.c index cf28528842bc..f6cad39f35df 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -1611,7 +1611,7 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *, return err; if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop))) - goto Efault; + return -EFAULT; user_access_begin(); unsafe_put_user(signo, &infop->si_signo, Efault); @@ -1739,7 +1739,7 @@ COMPAT_SYSCALL_DEFINE5(waitid, return err; if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop))) - goto Efault; + return -EFAULT; user_access_begin(); unsafe_put_user(signo, &infop->si_signo, Efault); -- 2.7.4 -- Kees Cook Pixel Security