waitid(): Avoid unbalanced user_access_end() on access_ok() error
PATCH 1/1 waitid(): Avoid unbalanced user_access_end() on access_ok() error
As pointed out by Linus and David, the earlier waitid() fix resulted in a (currently harmless) unbalanced user_access_end() call. This fixes it to just directly return EFAULT on access_ok() failure.
---
This seems best to get fixed up now (in the same release where it was introduced) before it tries to bite us at some later time.
--- kernel/exit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/exit.c +2 -2
@@ -1611,7 +1611,7 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,return err;if (!access_ok (VERIFY_WRITE , infop,sizeof (*infop))) - goto Efault; +return -EFAULT ;user_access_begin ();unsafe_put_user (signo, &infop->si_signo, Efault);
@@ -1739,7 +1739,7 @@ COMPAT_SYSCALL_DEFINE5(waitid,return err;if (!access_ok (VERIFY_WRITE , infop,sizeof (*infop))) - goto Efault; +return -EFAULT ;user_access_begin ();unsafe_put_user (signo, &infop->si_signo, Efault);
Signature · 6 lines
2.7.4 -- Kees Cook Pixel Security
Quoted 8 lines · Kees Cook
As pointed out by Linus and David, the earlier
waitid()fix resulted in a (currently harmless) unbalanceduser_access_end()call. This fixes it to just directly return EFAULT onaccess_ok()failure.Fixes 96ca579a1ecc ("waitid(): Add missing access_ok() checks")Cc Al Viro <[email protected]>Cc David Daney <[email protected]>Signed-off-by Kees Cook <[email protected]>
Thanks Kees, this looks better to me ...
Quoted 30 lines
---
This seems best to get fixed up now (in the same release where it was introduced) before it tries to bite us at some later time.--- kernel/exit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)kernel/exit.c +2
-2@@ -1611,7 +1611,7 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,return err;if (!access_ok (VERIFY_WRITE , infop,sizeof (*infop))) - goto Efault; +return -EFAULT ;user_access_begin ();unsafe_put_user (signo, &infop->si_signo, Efault);@@ -1739,7 +1739,7 @@ COMPAT_SYSCALL_DEFINE5(waitid,return err;if (!access_ok (VERIFY_WRITE , infop,sizeof (*infop))) - goto Efault; +return -EFAULT ;user_access_begin ();unsafe_put_user (signo, &infop->si_signo, Efault);