lkml.org 
[lkml]   [2009]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH 8/9] Add explicit bound checks in mm/migrate.c
From: Arjan van de Ven <arjan@linux.intel.com>
Subject: [PATCH 8/9] Add explicit bound checks in mm/migrate.c
CC: akpm@linux-foundation.org

The memory migration code has some curious copy_from_user bounds,
that are likely ok, but are not immediately obvious to me or to GCC.

This patch adds a simple explicit bound check; this allows GCC
and me to be more assured that the copy_from_user will never overwrite
its destination buffer.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>


diff --git a/mm/migrate.c b/mm/migrate.c
index 1a4bf48..5b9ebc5 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1044,11 +1044,15 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
int err;

for (i = 0; i < nr_pages; i += chunk_nr) {
+ unsigned int copy;
if (chunk_nr + i > nr_pages)
chunk_nr = nr_pages - i;

- err = copy_from_user(chunk_pages, &pages[i],
- chunk_nr * sizeof(*chunk_pages));
+ copy = chunk_nr * sizeof(*chunk_pages);
+ if (copy > DO_PAGES_STAT_CHUNK_NR)
+ return -EFAULT;
+
+ err = copy_from_user(chunk_pages, &pages[i], copy);
if (err) {
err = -EFAULT;
goto out;

--
Arjan van de Ven Intel Open Source Technology Centre
For development, discussion and tips for power savings,
visit http://www.lesswatts.org


\
 
 \ /
  Last update: 2009-09-26 21:01    [W:0.132 / U:0.252 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site