fix infoleak in waitid(2)

BugLink: http://bugs.launchpad.net/bugs/1721777
commit 6c85501f2fabcfc4fc6ed976543d252c4eaf4be9 upstream.

kernel_waitid() can return a PID, an error or 0.  rusage is filled in the first
case and waitid(2) rusage should've been copied out exactly in that case, *not*
whenever kernel_waitid() has not returned an error.  Compat variant shares that
braino; none of kernel_wait4() callers do, so the below ought to fix it.

Reported-and-tested-by: Alexander Potapenko <glider@google.com>
Fixes: ce72a16fa705 ("wait4(2)/waitid(2): separate copying rusage to userland")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/kernel/exit.c b/kernel/exit.c
index b3c69c3a60b2f6658136581538c4bebdb8583d60..135b36985f8a2d9ca30a1a33737cb5cc1e3f0bc3 100644 (file)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1601,12 +1601,10 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
        struct waitid_info info = {.status = 0};
        long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL);
        int signo = 0;
+
        if (err > 0) {
                signo = SIGCHLD;
                err = 0;
-       }
-
-       if (!err) {
                if (ru && copy_to_user(ru, &r, sizeof(struct rusage)))
                        return -EFAULT;
        }
@@ -1727,16 +1725,15 @@ COMPAT_SYSCALL_DEFINE5(waitid,
        if (err > 0) {
                signo = SIGCHLD;
                err = 0;
-       }
-
-       if (!err && uru) {
-               /* kernel_waitid() overwrites everything in ru */
-               if (COMPAT_USE_64BIT_TIME)
-                       err = copy_to_user(uru, &ru, sizeof(ru));
-               else
-                       err = put_compat_rusage(&ru, uru);
-               if (err)
-                       return -EFAULT;
+               if (uru) {
+                       /* kernel_waitid() overwrites everything in ru */
+                       if (COMPAT_USE_64BIT_TIME)
+                               err = copy_to_user(uru, &ru, sizeof(ru));
+                       else
+                               err = put_compat_rusage(&ru, uru);
+                       if (err)
+                               return -EFAULT;
+               }
        }
 
        if (!infop)