From c896aa932cde9c61af6ee5d6cb7b7ca71409b8d7 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 12 Oct 2017 22:28:48 +0200
Subject: [PATCH] 4.13-stable patches

added patches:
	waitid-add-missing-access_ok-checks.patch
---
 queue-4.13/series                             |  1 +
 .../waitid-add-missing-access_ok-checks.patch | 46 +++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 queue-4.13/waitid-add-missing-access_ok-checks.patch

diff --git a/queue-4.13/series b/queue-4.13/series
index baf59bf4231..48e55412047 100644
--- a/queue-4.13/series
+++ b/queue-4.13/series
@@ -1 +1,2 @@
 watchdog-revert-itco_wdt-all-versions-count-down-twice.patch
+waitid-add-missing-access_ok-checks.patch
diff --git a/queue-4.13/waitid-add-missing-access_ok-checks.patch b/queue-4.13/waitid-add-missing-access_ok-checks.patch
new file mode 100644
index 00000000000..031b7322e9e
--- /dev/null
+++ b/queue-4.13/waitid-add-missing-access_ok-checks.patch
@@ -0,0 +1,46 @@
+From 96ca579a1ecc943b75beba58bebb0356f6cc4b51 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Mon, 9 Oct 2017 11:36:52 -0700
+Subject: waitid(): Add missing access_ok() checks
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 96ca579a1ecc943b75beba58bebb0356f6cc4b51 upstream.
+
+Adds missing access_ok() checks.
+
+CVE-2017-5123
+
+Reported-by: Chris Salls <chrissalls5@gmail.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Acked-by: Al Viro <viro@zeniv.linux.org.uk>
+Fixes: 4c48abe91be0 ("waitid(): switch copyout of siginfo to unsafe_put_user()")
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/exit.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -1611,6 +1611,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_
+ 	if (!infop)
+ 		return err;
+ 
++	if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
++		goto Efault;
++
+ 	user_access_begin();
+ 	unsafe_put_user(signo, &infop->si_signo, Efault);
+ 	unsafe_put_user(0, &infop->si_errno, Efault);
+@@ -1736,6 +1739,9 @@ COMPAT_SYSCALL_DEFINE5(waitid,
+ 	if (!infop)
+ 		return err;
+ 
++	if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
++		goto Efault;
++
+ 	user_access_begin();
+ 	unsafe_put_user(signo, &infop->si_signo, Efault);
+ 	unsafe_put_user(0, &infop->si_errno, Efault);
-- 
2.47.3