Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
Subject: Re: [PATCH] mm/usercopy: Use memory range to be accessed for
 wraparound check
From:   William Kucharski <william.kucharski@oracle.com>
In-Reply-To: <1542156686-12253-1-git-send-email-isaacm@codeaurora.org>
Date:   Wed, 14 Nov 2018 03:35:25 -0700
Cc:     Kees Cook <keescook@chromium.org>, crecklin@redhat.com,
        linux-mm@kvack.org, linux-kernel@vger.kernel.org,
        psodagud@codeaurora.org, tsoni@codeaurora.org,
        stable@vger.kernel.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <FFE931C2-DE41-4AD8-866B-FD37C1493590@oracle.com>
References: <1542156686-12253-1-git-send-email-isaacm@codeaurora.org>
To:     "Isaac J. Manjarres" <isaacm@codeaurora.org>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> On Nov 13, 2018, at 5:51 PM, Isaac J. Manjarres =
<isaacm@codeaurora.org> wrote:
>=20
> diff --git a/mm/usercopy.c b/mm/usercopy.c
> index 852eb4e..0293645 100644
> --- a/mm/usercopy.c
> +++ b/mm/usercopy.c
> @@ -151,7 +151,7 @@ static inline void check_bogus_address(const =
unsigned long ptr, unsigned long n,
> 				       bool to_user)
> {
> 	/* Reject if object wraps past end of memory. */
> -	if (ptr + n < ptr)
> +	if (ptr + (n - 1) < ptr)
> 		usercopy_abort("wrapped address", NULL, to_user, 0, ptr =
+ n);

I'm being paranoid, but is it possible this routine could ever be passed =
"n" set to zero?

If so, it will erroneously abort indicating a wrapped address as (n - 1) =
wraps to ULONG_MAX.

Easily fixed via:

	if ((n !=3D 0) && (ptr + (n - 1) < ptr))

William Kucharski=