From: Eric Biggers Date: Fri, 19 Aug 2016 19:15:22 +0000 (-0700) Subject: usercopy: avoid potentially undefined behavior in pointer math X-Git-Tag: v4.8~180^2~1 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=7329a655875a2f4bd6984fe8a7e00a6981e802f3;p=platform%2Fkernel%2Flinux-amlogic.git usercopy: avoid potentially undefined behavior in pointer math check_bogus_address() checked for pointer overflow using this expression, where 'ptr' has type 'const void *': ptr + n < ptr Since pointer wraparound is undefined behavior, gcc at -O2 by default treats it like the following, which would not behave as intended: (long)n < 0 Fortunately, this doesn't currently happen for kernel code because kernel code is compiled with -fno-strict-overflow. But the expression should be fixed anyway to use well-defined integer arithmetic, since it could be treated differently by different compilers in the future or could be reported by tools checking for undefined behavior. Signed-off-by: Eric Biggers Signed-off-by: Kees Cook --- diff --git a/mm/usercopy.c b/mm/usercopy.c index 8ebae91..82f81df 100644 --- a/mm/usercopy.c +++ b/mm/usercopy.c @@ -124,7 +124,7 @@ static inline const char *check_kernel_text_object(const void *ptr, static inline const char *check_bogus_address(const void *ptr, unsigned long n) { /* Reject if object wraps past end of memory. */ - if (ptr + n < ptr) + if ((unsigned long)ptr + n < (unsigned long)ptr) return ""; /* Reject if NULL or ZERO-allocation. */