[PATCH 8/9] Add explicit bound checks in mm/migrate.c

[Arjan van de Ven <arjan@infradead.org>]

From: Arjan van de Ven <arjan@linux.intel.com>
Subject: [PATCH 8/9] Add explicit bound checks in mm/migrate.c
CC: akpm@linux-foundation.org

The memory migration code has some curious copy_from_user bounds,
that are likely ok, but are not immediately obvious to me or to GCC.

This patch adds a simple explicit bound check; this allows GCC
and me to be more assured that the copy_from_user will never overwrite
its destination buffer.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>


diff --git a/mm/migrate.c b/mm/migrate.c
index 1a4bf48..5b9ebc5 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1044,11 +1044,15 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
 	int err;
 
 	for (i = 0; i < nr_pages; i += chunk_nr) {
+		unsigned int copy;
 		if (chunk_nr + i > nr_pages)
 			chunk_nr = nr_pages - i;
 
-		err = copy_from_user(chunk_pages, &pages[i],
-				     chunk_nr * sizeof(*chunk_pages));
+		copy = chunk_nr * sizeof(*chunk_pages);
+		if (copy > DO_PAGES_STAT_CHUNK_NR)
+			return -EFAULT;
+
+		err = copy_from_user(chunk_pages, &pages[i], copy);
 		if (err) {
 			err = -EFAULT;
 			goto out;


-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org