Messages in this thread Patch in this message | | | Date | Sat, 26 Sep 2009 20:54:06 +0200 | From | Arjan van de Ven <> | Subject | [PATCH 8/9] Add explicit bound checks in mm/migrate.c |
| |
From: Arjan van de Ven <arjan@linux.intel.com> Subject: [PATCH 8/9] Add explicit bound checks in mm/migrate.c CC: akpm@linux-foundation.org
The memory migration code has some curious copy_from_user bounds, that are likely ok, but are not immediately obvious to me or to GCC.
This patch adds a simple explicit bound check; this allows GCC and me to be more assured that the copy_from_user will never overwrite its destination buffer.
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
diff --git a/mm/migrate.c b/mm/migrate.c index 1a4bf48..5b9ebc5 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -1044,11 +1044,15 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages, int err; for (i = 0; i < nr_pages; i += chunk_nr) { + unsigned int copy; if (chunk_nr + i > nr_pages) chunk_nr = nr_pages - i; - err = copy_from_user(chunk_pages, &pages[i], - chunk_nr * sizeof(*chunk_pages)); + copy = chunk_nr * sizeof(*chunk_pages); + if (copy > DO_PAGES_STAT_CHUNK_NR) + return -EFAULT; + + err = copy_from_user(chunk_pages, &pages[i], copy); if (err) { err = -EFAULT; goto out;
-- Arjan van de Ven Intel Open Source Technology Centre For development, discussion and tips for power savings, visit http://www.lesswatts.org
| |