Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
mm/usercopy: use memory range to be accessed for wraparound check
Currently, when checking to see if accessing n bytes starting at address "ptr" will cause a wraparound in the memory addresses, the check in check_bogus_address() adds an extra byte, which is incorrect, as the range of addresses that will be accessed is [ptr, ptr + (n - 1)]. This can lead to incorrectly detecting a wraparound in the memory address, when trying to read 4 KB from memory that is mapped to the the last possible page in the virtual address space, when in fact, accessing that range of memory would not cause a wraparound to occur. Use the memory range that will actually be accessed when considering if accessing a certain amount of bytes will cause the memory address to wrap around. Link: http://lkml.kernel.org/r/[email protected] Fixes: f5509cc ("mm: Hardened usercopy") Signed-off-by: Prasad Sodagudi <[email protected]> Signed-off-by: Isaac J. Manjarres <[email protected]> Co-developed-by: Prasad Sodagudi <[email protected]> Reviewed-by: William Kucharski <[email protected]> Acked-by: Kees Cook <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Cc: Trilok Soni <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
- Loading branch information