waitid(): Add missing access_ok() checks

Adds missing access_ok() checks.

CVE-2017-5123

Reported-by: Chris Salls <chrissalls5@gmail.com>
Fixes: 4c48abe91be0 ("waitid(): switch copyout of siginfo to unsafe_put_user()")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/kernel/exit.c b/kernel/exit.c
index c5548faa9f377c5bf01f4a4db8e3020448565469..b3c69c3a60b2f6658136581538c4bebdb8583d60 100644 (file)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1613,6 +1613,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
        if (!infop)
                return err;
 
+       if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+               goto Efault;
+
        user_access_begin();
        unsafe_put_user(signo, &infop->si_signo, Efault);
        unsafe_put_user(0, &infop->si_errno, Efault);
@@ -1739,6 +1742,9 @@ COMPAT_SYSCALL_DEFINE5(waitid,
        if (!infop)
                return err;
 
+       if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+               goto Efault;
+
        user_access_begin();
        unsafe_put_user(signo, &infop->si_signo, Efault);
        unsafe_put_user(0, &infop->si_errno, Efault);