fix infoleak in waitid(2) (6c85501f) · Commits · 戴 / test

kernel_waitid() can return a PID, an error or 0. rusage is filled in the first case and waitid(2) rusage should've been copied out exactly in that case, *not* whenever kernel_waitid() has not returned an error. Compat variant shares that braino; none of kernel_wait4() callers do, so the below ought to fix it. Reported-and-tested-by:

Alexander Potapenko <glider@google.com> Fixes: ("wait4(2)/waitid(2): separate copying rusage to userland") Cc: stable@vger.kernel.org # v4.13 Signed-off-by:

Al Viro <viro@zeniv.linux.org.uk>

kernel/exit.c

+10 −13

Original line number	Diff line number	Diff line
		@@ -1600,12 +1600,10 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
		struct waitid_info info = {.status = 0};
		long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL);
		int signo = 0;

		if (err > 0) {
		signo = SIGCHLD;
		err = 0;
		}

		if (!err) {
		if (ru && copy_to_user(ru, &r, sizeof(struct rusage)))
		return -EFAULT;
		}
		@@ -1723,9 +1721,7 @@ COMPAT_SYSCALL_DEFINE5(waitid,
		if (err > 0) {
		signo = SIGCHLD;
		err = 0;
		}

		if (!err && uru) {
		if (uru) {
		/* kernel_waitid() overwrites everything in ru */
		if (COMPAT_USE_64BIT_TIME)
		err = copy_to_user(uru, &ru, sizeof(ru));
		@@ -1734,6 +1730,7 @@ COMPAT_SYSCALL_DEFINE5(waitid,
		if (err)
		return -EFAULT;
		}
		}

		if (!infop)
		return err;

Admin message