The patch titled exec.c, compat.c: fix count(), compat_count() bounds checking has been removed from the -mm tree. Its filename was fix-count-compat_count-bounds-checking.patch This patch was dropped because it was merged into mainline or a subsystem tree The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: exec.c, compat.c: fix count(), compat_count() bounds checking From: Jason Baron <jbaron@xxxxxxxxxx> With MAX_ARG_STRINGS set to 0x7FFFFFFF, and being passed to 'count()' and compat_count(), it would appear that the current max bounds check of fs/exec.c:394: if(++i > max) return -E2BIG; would never trigger. Since 'i' is of type int, so values would wrap and the function would continue looping. Simple fix seems to be chaning ++i to i++ and checking for '>='. Signed-off-by: Jason Baron <jbaron@xxxxxxxxxx> Acked-by: Peter Zijlstra <a.p.zijlstra@xxxxxxxxx> Cc: "Ollie Wild" <aaw@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/compat.c | 2 +- fs/exec.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff -puN fs/compat.c~fix-count-compat_count-bounds-checking fs/compat.c --- a/fs/compat.c~fix-count-compat_count-bounds-checking +++ a/fs/compat.c @@ -1239,7 +1239,7 @@ static int compat_count(compat_uptr_t __ if (!p) break; argv++; - if(++i > max) + if (i++ >= max) return -E2BIG; } } diff -puN fs/exec.c~fix-count-compat_count-bounds-checking fs/exec.c --- a/fs/exec.c~fix-count-compat_count-bounds-checking +++ a/fs/exec.c @@ -391,7 +391,7 @@ static int count(char __user * __user * if (!p) break; argv++; - if(++i > max) + if (i++ >= max) return -E2BIG; cond_resched(); } _ Patches currently in -mm which might be from jbaron@xxxxxxxxxx are origin.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html