From: Russell King <rmk+kernel@xxxxxxxxxxxxxxxx> Subject: kexec: ensure user memory sizes do not wrap Ensure that user memory sizes do not wrap around when validating the user input, which can lead to the following input validation working incorrectly. [akpm@xxxxxxxxxxxxxxxxxxxx: fix it for kexec-return-error-number-directly.patch] Link: http://lkml.kernel.org/r/E1b8koF-0004HM-5x@xxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Russell King <rmk+kernel@xxxxxxxxxxxxxxxx> Reviewed-by: Pratyush Anand <panand@xxxxxxxxxx> Acked-by: Baoquan He <bhe@xxxxxxxxxx> Cc: Keerthy <j-keerthy@xxxxxx> Cc: Vitaly Andrianov <vitalya@xxxxxx> Cc: Eric Biederman <ebiederm@xxxxxxxxxxxx> Cc: Dave Young <dyoung@xxxxxxxxxx> Cc: Vivek Goyal <vgoyal@xxxxxxxxxx> Cc: Simon Horman <horms@xxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- kernel/kexec_core.c | 2 ++ 1 file changed, 2 insertions(+) diff -puN kernel/kexec_core.c~kexec-ensure-user-memory-sizes-do-not-wrap kernel/kexec_core.c --- a/kernel/kexec_core.c~kexec-ensure-user-memory-sizes-do-not-wrap +++ a/kernel/kexec_core.c @@ -168,6 +168,8 @@ int sanity_check_segment_list(struct kim mstart = image->segment[i].mem; mend = mstart + image->segment[i].memsz; + if (mstart > mend) + return -EADDRNOTAVAIL; if ((mstart & ~PAGE_MASK) || (mend & ~PAGE_MASK)) return -EADDRNOTAVAIL; if (mend >= KEXEC_DESTINATION_MEMORY_LIMIT) _ -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
