summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric Biggers <ebiggers@google.com>2016-08-19 12:15:22 -0700
committerKees Cook <keescook@chromium.org>2016-08-22 19:07:55 -0700
commit7329a655875a2f4bd6984fe8a7e00a6981e802f3 (patch)
tree5c77614be62600da9d02d3b57709280e91e7292d
parentef0e1ea8856bed6ff8394d3dfe77f2cab487ecea (diff)
usercopy: avoid potentially undefined behavior in pointer math
check_bogus_address() checked for pointer overflow using this expression, where 'ptr' has type 'const void *': ptr + n < ptr Since pointer wraparound is undefined behavior, gcc at -O2 by default treats it like the following, which would not behave as intended: (long)n < 0 Fortunately, this doesn't currently happen for kernel code because kernel code is compiled with -fno-strict-overflow. But the expression should be fixed anyway to use well-defined integer arithmetic, since it could be treated differently by different compilers in the future or could be reported by tools checking for undefined behavior. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Kees Cook <keescook@chromium.org>
-rw-r--r--mm/usercopy.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/mm/usercopy.c b/mm/usercopy.c
index 8ebae91a6b55..82f81df2edcf 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -124,7 +124,7 @@ static inline const char *check_kernel_text_object(const void *ptr,
static inline const char *check_bogus_address(const void *ptr, unsigned long n)
{
/* Reject if object wraps past end of memory. */
- if (ptr + n < ptr)
+ if ((unsigned long)ptr + n < (unsigned long)ptr)
return "<wrapped address>";
/* Reject if NULL or ZERO-allocation. */