From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752160AbbCYKhI (ORCPT ); Wed, 25 Mar 2015 06:37:08 -0400 Received: from bes.se.axis.com ([195.60.68.10]:40365 "EHLO bes.se.axis.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751916AbbCYKhG (ORCPT ); Wed, 25 Mar 2015 06:37:06 -0400 Date: Wed, 25 Mar 2015 11:37:02 +0100 From: Jesper Nilsson To: Andrey Ryabinin Cc: Mikael Starvik , Jesper Nilsson , linux-cris-kernel@axis.com, linux-kernel@vger.kernel.org, Kees Cook , Yury Gribov Subject: Re: [PATCH] cris: fix integer overflow in ELF_ET_DYN_BASE Message-ID: <20150325103702.GF26081@axis.com> References: <1427211084-24839-1-git-send-email-a.ryabinin@samsung.com> <1427211084-24839-2-git-send-email-a.ryabinin@samsung.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1427211084-24839-2-git-send-email-a.ryabinin@samsung.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Mar 24, 2015 at 06:31:23PM +0300, Andrey Ryabinin wrote: > Almost all arches define ELF_ET_DYN_BASE as 2/3 of TASK_SIZE. > Though it seems that some architectures do this in a wrong way. > The problem is that 2*TASK_SIZE may overflow 32-bits so > the real ELF_ET_DYN_BASE becomes wrong. > Fix this overflow by dividing TASK_SIZE prior to multiplying: > (TASK_SIZE / 3 * 2) Good catch, thanks, added to the CRIS-tree. > Signed-off-by: Andrey Ryabinin /^JN - Jesper Nilsson -- Jesper Nilsson -- jesper.nilsson@axis.com