Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a1dcf6a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'usercopy-v4.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 

Pull hardened usercopy fixes from Kees Cook:
 - avoid signed math problems on unexpected compilers
 - avoid false positives at very end of kernel text range checks

* tag 'usercopy-v4.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  usercopy: fix overlap check for kernel text
  usercopy: avoid potentially undefined behavior in pointer math
parents d1fdafa1 94cd97af

mm/usercopy.c

+2 −2
Original line number Diff line number Diff line
@@ -83,7 +83,7 @@ static bool overlaps(const void *ptr, unsigned long n, unsigned long low, 
	unsigned long check_high = check_low + n;



	/* Does not overlap if entirely above or entirely below. */

	if (check_low >= high || check_high < low)

	if (check_low >= high || check_high <= low)

		return false;



	return true;
@@ -124,7 +124,7 @@ static inline const char *check_kernel_text_object(const void *ptr, 
static inline const char *check_bogus_address(const void *ptr, unsigned long n)

{

	/* Reject if object wraps past end of memory. */

	if (ptr + n < ptr)

	if ((unsigned long)ptr + n < (unsigned long)ptr)

		return "<wrapped address>";



	/* Reject if NULL or ZERO-allocation. */