diff options
| author | Wolfram Sang <wsa@kernel.org> | 2020-05-20 15:27:45 +0200 |
|---|---|---|
| committer | Wolfram Sang <wsa@kernel.org> | 2020-05-20 15:27:45 +0200 |
| commit | f89c326dcaa0cb8c3af7764e75eeed4e3f3c879a (patch) | |
| tree | 31a5967da1f04180a1a922258f6947ad17255ee8 /kernel/fork.c | |
| parent | 6fe12cdbcfe35ad4726a619a9546822d34fc934c (diff) | |
| parent | efa7fb4c6c8e4171fd29a5935a9dc7a28e363278 (diff) | |
Merge branch 'i2c/for-current-fixed' into i2c/for-5.8
Diffstat (limited to 'kernel/fork.c')
| -rw-r--r-- | kernel/fork.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/kernel/fork.c b/kernel/fork.c index 4385f3d639f2..8c700f881d92 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2605,6 +2605,14 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs, struct clone_args args; pid_t *kset_tid = kargs->set_tid; + BUILD_BUG_ON(offsetofend(struct clone_args, tls) != + CLONE_ARGS_SIZE_VER0); + BUILD_BUG_ON(offsetofend(struct clone_args, set_tid_size) != + CLONE_ARGS_SIZE_VER1); + BUILD_BUG_ON(offsetofend(struct clone_args, cgroup) != + CLONE_ARGS_SIZE_VER2); + BUILD_BUG_ON(sizeof(struct clone_args) != CLONE_ARGS_SIZE_VER2); + if (unlikely(usize > PAGE_SIZE)) return -E2BIG; if (unlikely(usize < CLONE_ARGS_SIZE_VER0)) @@ -2631,7 +2639,8 @@ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs, !valid_signal(args.exit_signal))) return -EINVAL; - if ((args.flags & CLONE_INTO_CGROUP) && args.cgroup < 0) + if ((args.flags & CLONE_INTO_CGROUP) && + (args.cgroup > INT_MAX || usize < CLONE_ARGS_SIZE_VER2)) return -EINVAL; *kargs = (struct kernel_clone_args){ |