Commit 7a1dcf6a authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'usercopy-v4.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull hardened usercopy fixes from Kees Cook:
 - avoid signed math problems on unexpected compilers
 - avoid false positives at very end of kernel text range checks

* tag 'usercopy-v4.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  usercopy: fix overlap check for kernel text
  usercopy: avoid potentially undefined behavior in pointer math
parents d1fdafa1 94cd97af
...@@ -83,7 +83,7 @@ static bool overlaps(const void *ptr, unsigned long n, unsigned long low, ...@@ -83,7 +83,7 @@ static bool overlaps(const void *ptr, unsigned long n, unsigned long low,
unsigned long check_high = check_low + n; unsigned long check_high = check_low + n;
/* Does not overlap if entirely above or entirely below. */ /* Does not overlap if entirely above or entirely below. */
if (check_low >= high || check_high < low) if (check_low >= high || check_high <= low)
return false; return false;
return true; return true;
...@@ -124,7 +124,7 @@ static inline const char *check_kernel_text_object(const void *ptr, ...@@ -124,7 +124,7 @@ static inline const char *check_kernel_text_object(const void *ptr,
static inline const char *check_bogus_address(const void *ptr, unsigned long n) static inline const char *check_bogus_address(const void *ptr, unsigned long n)
{ {
/* Reject if object wraps past end of memory. */ /* Reject if object wraps past end of memory. */
if (ptr + n < ptr) if ((unsigned long)ptr + n < (unsigned long)ptr)
return "<wrapped address>"; return "<wrapped address>";
/* Reject if NULL or ZERO-allocation. */ /* Reject if NULL or ZERO-allocation. */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment