> [BUG] Need a lower-bound check-- lo_encrypt_key_size is an int
> /home/kash/linux/2.4.6/drivers/block/loop.c:782:loop_set_status: ERROR:RANGE:757:782: Using user length "lo_encrypt_key_size" as argument to "memcpy" [type=LOCAL] [state = need_lb] set by 'copy_from_user':759 [linkages -> 759:info->lo_encrypt_key_size -> 757:info:start] [distance=110]
> 	if (lo->lo_encrypt_key_size && lo->lo_key_owner != current->uid &&

This one looks like a tool error

        if ((unsigned int) info.lo_encrypt_key_size > LO_KEY_SIZE)

so the check is cast

In looking at the located ones I also found it missed a pile of related problems
it can check

There were a pile of

 	item *p=kmalloc(sizeof(item)*num_items);
	if(p==NULL)
		error

	for(i=0;i<num_items;i++)
	{
		..
	}

Where people rely on the kmalloc failing but forget that

	large value * sizeof(item) -> small value after overflow
	and the loop stomps all over kernel memory..


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/