[prev in list] [next in list] [prev in thread] [next in thread] 

List:       git-commits-head
Subject:    fix infoleak in waitid(2)
From:       "Linux Kernel Mailing List" <linux-kernel () vger ! kernel ! org>
Date:       2017-09-29 20:02:04
Message-ID: 20170929200204.2FAEA21B60 () pdx-korg-gitolite-1 ! ci ! codeaurora ! org
[Download RAW message or body]

Web:        https://git.kernel.org/torvalds/c/6c85501f2fabcfc4fc6ed976543d252c4eaf4be9
Commit:     6c85501f2fabcfc4fc6ed976543d252c4eaf4be9
Parent:     b776e4b1a990045a7c70798f1f353c3160c26594
Refname:    refs/heads/master
Author:     Al Viro <viro@zeniv.linux.org.uk>
AuthorDate: Fri Sep 29 13:43:15 2017 -0400
Committer:  Al Viro <viro@zeniv.linux.org.uk>
CommitDate: Fri Sep 29 13:43:15 2017 -0400

    fix infoleak in waitid(2)
    
    kernel_waitid() can return a PID, an error or 0.  rusage is filled in the first
    case and waitid(2) rusage should've been copied out exactly in that case, *not*
    whenever kernel_waitid() has not returned an error.  Compat variant shares that
    braino; none of kernel_wait4() callers do, so the below ought to fix it.
    
    Reported-and-tested-by: Alexander Potapenko <glider@google.com>
    Fixes: ce72a16fa705 ("wait4(2)/waitid(2): separate copying rusage to userland")
    Cc: stable@vger.kernel.org # v4.13
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
 kernel/exit.c | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/kernel/exit.c b/kernel/exit.c
index 3481ababd06a..f2cd53e92147 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1600,12 +1600,10 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
 	struct waitid_info info = {.status = 0};
 	long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL);
 	int signo = 0;
+
 	if (err > 0) {
 		signo = SIGCHLD;
 		err = 0;
-	}
-
-	if (!err) {
 		if (ru && copy_to_user(ru, &r, sizeof(struct rusage)))
 			return -EFAULT;
 	}
@@ -1723,16 +1721,15 @@ COMPAT_SYSCALL_DEFINE5(waitid,
 	if (err > 0) {
 		signo = SIGCHLD;
 		err = 0;
-	}
-
-	if (!err && uru) {
-		/* kernel_waitid() overwrites everything in ru */
-		if (COMPAT_USE_64BIT_TIME)
-			err = copy_to_user(uru, &ru, sizeof(ru));
-		else
-			err = put_compat_rusage(&ru, uru);
-		if (err)
-			return -EFAULT;
+		if (uru) {
+			/* kernel_waitid() overwrites everything in ru */
+			if (COMPAT_USE_64BIT_TIME)
+				err = copy_to_user(uru, &ru, sizeof(ru));
+			else
+				err = put_compat_rusage(&ru, uru);
+			if (err)
+				return -EFAULT;
+		}
 	}
 
 	if (!infop)
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]