From patchwork Fri Jun 3 08:50:27 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Russell King X-Patchwork-Id: 9152307 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E63F26072B for ; Fri, 3 Jun 2016 09:03:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D9F1426D19 for ; Fri, 3 Jun 2016 09:03:49 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CEECC28309; Fri, 3 Jun 2016 09:03:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id ADA2026D19 for ; Fri, 3 Jun 2016 09:03:48 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1b8l0V-0008JY-LL; Fri, 03 Jun 2016 09:03:07 +0000 Received: from pandora.armlinux.org.uk ([2001:4d48:ad52:3201:214:fdff:fe10:1be6]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1b8kog-0006y3-LZ for linux-arm-kernel@lists.infradead.org; Fri, 03 Jun 2016 08:50:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=armlinux.org.uk; s=pandora-2014; h=Date:Sender:Message-Id:Content-Type:Content-Transfer-Encoding:MIME-Version:Subject:Cc:To:From; bh=+5UO5yPy8jwAvv669pw+aqmRbunWEFmMQ8xiSt6hu6I=; b=igTLb5lTH4gu2OFWHGtyRFiDJnExBpG4+aSq3cFtRkAY0PTmOC/o6cDekHFn1YbKEVhUCrD6ajqQtSjLy3yr/SCmw3t+QUfG9X2YOZlvgq3QxZDwx2jhJZ3ouCnX6DQ3060+6U4knSxPTjseCdQIEOgRPXEUhLJ6tlP00YBO4zs=; Received: from e0022681537dd.dyn.armlinux.org.uk ([2002:4e20:1eda:1:222:68ff:fe15:37dd]:39525 helo=rmk-PC.armlinux.org.uk) by pandora.armlinux.org.uk with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1b8koI-0007Fp-7v; Fri, 03 Jun 2016 09:50:30 +0100 Received: from rmk by rmk-PC.armlinux.org.uk with local (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1b8koF-0004HM-5x; Fri, 03 Jun 2016 09:50:27 +0100 From: Russell King To: Andrew Morton Subject: [PATCH 4/8] kexec: ensure user memory sizes do not wrap MIME-Version: 1.0 Content-Disposition: inline Message-Id: Date: Fri, 03 Jun 2016 09:50:27 +0100 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20160603_015055_361283_5FCA84CB X-CRM114-Status: GOOD ( 10.13 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-ia64@vger.kernel.org, kexec@lists.infradead.org, Eric Biederman , linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP Ensure that user memory sizes do not wrap around when validating the user input, which can lead to the following input validation working incorrectly. Acked-by: Baoquan He Reviewed-by: Pratyush Anand Signed-off-by: Russell King --- kernel/kexec_core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c index 8d34308ea449..d719a4d0ef55 100644 --- a/kernel/kexec_core.c +++ b/kernel/kexec_core.c @@ -169,6 +169,8 @@ int sanity_check_segment_list(struct kimage *image) mstart = image->segment[i].mem; mend = mstart + image->segment[i].memsz; + if (mstart > mend) + return result; if ((mstart & ~PAGE_MASK) || (mend & ~PAGE_MASK)) return result; if (mend >= KEXEC_DESTINATION_MEMORY_LIMIT)