Stable Archive on
 help / color / Atom feed
* [patch 11/18] mm/usercopy: use memory range to be accessed for wraparound check
@ 2019-08-13 22:37 akpm
  0 siblings, 0 replies; only message in thread
From: akpm @ 2019-08-13 22:37 UTC (permalink / raw)
  To: william.kucharski, tsoni, stable, psodagud, keescook, gregkh,
	isaacm, akpm, mm-commits, torvalds

From: "Isaac J. Manjarres" <>
Subject: mm/usercopy: use memory range to be accessed for wraparound check

Currently, when checking to see if accessing n bytes starting at address
"ptr" will cause a wraparound in the memory addresses, the check in
check_bogus_address() adds an extra byte, which is incorrect, as the range
of addresses that will be accessed is [ptr, ptr + (n - 1)].

This can lead to incorrectly detecting a wraparound in the memory address,
when trying to read 4 KB from memory that is mapped to the the last
possible page in the virtual address space, when in fact, accessing that
range of memory would not cause a wraparound to occur.

Use the memory range that will actually be accessed when considering if
accessing a certain amount of bytes will cause the memory address to wrap

Fixes: f5509cc18daa ("mm: Hardened usercopy")
Signed-off-by: Prasad Sodagudi <>
Signed-off-by: Isaac J. Manjarres <>
Co-developed-by: Prasad Sodagudi <>
Reviewed-by: William Kucharski <>
Acked-by: Kees Cook <>
Cc: Greg Kroah-Hartman <>
Cc: Trilok Soni <>
Cc: <>
Signed-off-by: Andrew Morton <>

 mm/usercopy.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/mm/usercopy.c~mm-usercopy-use-memory-range-to-be-accessed-for-wraparound-check
+++ a/mm/usercopy.c
@@ -147,7 +147,7 @@ static inline void check_bogus_address(c
 				       bool to_user)
 	/* Reject if object wraps past end of memory. */
-	if (ptr + n < ptr)
+	if (ptr + (n - 1) < ptr)
 		usercopy_abort("wrapped address", NULL, to_user, 0, ptr + n);
 	/* Reject if NULL or ZERO-allocation. */

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-13 22:37 [patch 11/18] mm/usercopy: use memory range to be accessed for wraparound check akpm

Stable Archive on

Archives are clonable:
	git clone --mirror stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ \
	public-inbox-index stable

Newsgroup available over NNTP:

AGPL code for this site: git clone public-inbox