lkml.org 
[lkml]   [2023]   [Aug]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 2/5] kernel: kexec: copy user-array safely
    Date
    Currently, there is no overflow-check with memdup_user().

    Use the new function memdup_array_user() instead of memdup_user() for
    duplicating the user-space array safely.

    Suggested-by: David Airlie <airlied@redhat.com>
    Signed-off-by: Philipp Stanner <pstanner@redhat.com>
    ---
    kernel/kexec.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/kernel/kexec.c b/kernel/kexec.c
    index 92d301f98776..f6067c1bb089 100644
    --- a/kernel/kexec.c
    +++ b/kernel/kexec.c
    @@ -242,7 +242,7 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments,
    ((flags & KEXEC_ARCH_MASK) != KEXEC_ARCH_DEFAULT))
    return -EINVAL;

    - ksegments = memdup_user(segments, nr_segments * sizeof(ksegments[0]));
    + ksegments = memdup_array_user(segments, nr_segments, sizeof(ksegments[0]));
    if (IS_ERR(ksegments))
    return PTR_ERR(ksegments);

    --
    2.41.0
    \
     
     \ /
      Last update: 2023-08-30 20:53    [W:4.623 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site