diff options
| author | Matthew Wilcox (Oracle) <willy@infradead.org> | 2022-06-12 22:32:27 +0100 |
|---|---|---|
| committer | Kees Cook <keescook@chromium.org> | 2022-06-13 09:54:52 -0700 |
| commit | 1dfbe9fcda4afc957f0e371e207ae3cb7e8f3b0e (patch) | |
| tree | 5d113acb38d1b7af478d04036fc46d55134c578b /kernel/cfi.c | |
| parent | 35fb9ae4aa2e838b234323e6f7cf6336ff019e5a (diff) | |
| download | linux-1dfbe9fcda4afc957f0e371e207ae3cb7e8f3b0e.tar.bz2 | |
usercopy: Make usercopy resilient against ridiculously large copies
If 'n' is so large that it's negative, we might wrap around and mistakenly
think that the copy is OK when it's not. Such a copy would probably
crash, but just doing the arithmetic in a more simple way lets us detect
and refuse this case.
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Tested-by: Zorro Lang <zlang@redhat.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220612213227.3881769-4-willy@infradead.org
Diffstat (limited to 'kernel/cfi.c')
0 files changed, 0 insertions, 0 deletions