Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=80381 Reported-by: David Binderman <dcb314@xxxxxxxxxxx> Signed-off-by: Andrey Utkin <andrey.krieger.utkin@xxxxxxxxx> --- arch/sh/kernel/ptrace_32.c | 4 ++-- arch/sh/kernel/ptrace_64.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c index c1a6b89..78effcb 100644 --- a/arch/sh/kernel/ptrace_32.c +++ b/arch/sh/kernel/ptrace_32.c @@ -379,7 +379,7 @@ long arch_ptrace(struct task_struct *child, long request, unsigned long tmp; ret = -EIO; - if ((addr & 3) || addr < 0 || + if ((addr & 3) || addr > sizeof(struct user) - 3) break; @@ -419,7 +419,7 @@ long arch_ptrace(struct task_struct *child, long request, case PTRACE_POKEUSR: /* write the word at location addr in the USER area */ ret = -EIO; - if ((addr & 3) || addr < 0 || + if ((addr & 3) || addr > sizeof(struct user) - 3) break; diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c index 5cea973..138b2b1 100644 --- a/arch/sh/kernel/ptrace_64.c +++ b/arch/sh/kernel/ptrace_64.c @@ -395,7 +395,7 @@ long arch_ptrace(struct task_struct *child, long request, unsigned long tmp; ret = -EIO; - if ((addr & 3) || addr < 0) + if (addr & 3) break; if (addr < sizeof(struct pt_regs)) @@ -423,7 +423,7 @@ long arch_ptrace(struct task_struct *child, long request, this could crash the kernel or result in a security loophole. */ ret = -EIO; - if ((addr & 3) || addr < 0) + if (addr & 3) break; if (addr < sizeof(struct pt_regs)) { -- 1.8.5.5 -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
