[PATCH 8/9] Add explicit bound checks in mm/migrate.c

Arjan van de Ven
2009-09-26T18:55:16Z

Subject: [PATCH 8/9] Add explicit bound checks in mm/migrate.c
CC: akpm@linux-foundation.org

The memory migration code has some curious copy_from_user bounds,
that are likely ok, but are not immediately obvious to me or to GCC.

This patch adds a simple explicit bound check; this allows GCC
and me to be more assured that the copy_from_user will never overwrite
its destination buffer.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>

diff --git a/mm/migrate.c b/mm/migrate.c
index 1a4bf48..5b9ebc5 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1044,11 +1044,15 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
int err;

for (i = 0; i < nr_pages; i += chunk_nr) {
+ unsigned int copy;
if (chunk_nr + i > nr_pages)
chunk_nr = nr_pages - i;

- err = copy_from_user(chunk_pages, &pages[i],
- chunk_nr * sizeof(*chunk_pages));
+ copy = chunk_nr * sizeof(*chunk_pages);
+ if (copy > DO_PAGES_STAT_CHUNK_NR)
+ return -EFAULT;
+
+ err = copy_from_user(chunk_pages, &pages[i], copy);
if (err) {
err = -EFAULT;
goto out;