The patch titled Subject: mm/usercopy: use memory range to be accessed for wraparound check has been added to the -mm tree. Its filename is mm-usercopy-use-memory-range-to-be-accessed-for-wraparound-check.patch

This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/mm-usercopy-use-memory-range-to-be-... and later at http://ozlabs.org/~akpm/mmotm/broken-out/mm-usercopy-use-memory-range-to-be-...

Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated there every 3-4 working days

------------------------------------------------------ From: "Isaac J. Manjarres" isaacm@codeaurora.org Subject: mm/usercopy: use memory range to be accessed for wraparound check

Currently, when checking to see if accessing n bytes starting at address "ptr" will cause a wraparound in the memory addresses, the check in check_bogus_address() adds an extra byte, which is incorrect, as the range of addresses that will be accessed is [ptr, ptr + (n - 1)].

This can lead to incorrectly detecting a wraparound in the memory address, when trying to read 4 KB from memory that is mapped to the the last possible page in the virtual address space, when in fact, accessing that range of memory would not cause a wraparound to occur.

Use the memory range that will actually be accessed when considering if accessing a certain amount of bytes will cause the memory address to wrap around.

Link: http://lkml.kernel.org/r/1564509253-23287-1-git-send-email-isaacm@codeaurora... Fixes: f5509cc18daa ("mm: Hardened usercopy") Signed-off-by: Prasad Sodagudi psodagud@codeaurora.org Signed-off-by: Isaac J. Manjarres isaacm@codeaurora.org Co-developed-by: Prasad Sodagudi psodagud@codeaurora.org Reviewed-by: William Kucharski william.kucharski@oracle.com Acked-by: Kees Cook keescook@chromium.org Cc: Greg Kroah-Hartman gregkh@linuxfoundation.org Cc: Trilok Soni tsoni@codeaurora.org Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org ---

mm/usercopy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/mm/usercopy.c~mm-usercopy-use-memory-range-to-be-accessed-for-wraparound-check +++ a/mm/usercopy.c @@ -147,7 +147,7 @@ static inline void check_bogus_address(c bool to_user) { /* Reject if object wraps past end of memory. */ - if (ptr + n < ptr) + if (ptr + (n - 1) < ptr) usercopy_abort("wrapped address", NULL, to_user, 0, ptr + n);

/* Reject if NULL or ZERO-allocation. */ _

Patches currently in -mm which might be from isaacm@codeaurora.org are

mm-usercopy-use-memory-range-to-be-accessed-for-wraparound-check.patch