diff options
| author | Russell King <[email protected]> | 2016-08-02 14:05:57 -0700 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2016-08-02 19:35:26 -0400 |
| commit | 465d377701dfe6a08a9f361a3fd926dea7f89c74 (patch) | |
| tree | 12138ab84eed21bfc244408d15179061685cac1d | |
| parent | dc5cccacf4272da4aba20a1fc0804d59d985ab32 (diff) | |
kexec: ensure user memory sizes do not wrap
Ensure that user memory sizes do not wrap around when validating the
user input, which can lead to the following input validation working
incorrectly.
[[email protected]: fix it for kexec-return-error-number-directly.patch]
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Russell King <[email protected]>
Reviewed-by: Pratyush Anand <[email protected]>
Acked-by: Baoquan He <[email protected]>
Cc: Keerthy <[email protected]>
Cc: Vitaly Andrianov <[email protected]>
Cc: Eric Biederman <[email protected]>
Cc: Dave Young <[email protected]>
Cc: Vivek Goyal <[email protected]>
Cc: Simon Horman <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
| -rw-r--r-- | kernel/kexec_core.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c index 23311c803b1b..5a83b2a9d584 100644 --- a/kernel/kexec_core.c +++ b/kernel/kexec_core.c @@ -168,6 +168,8 @@ int sanity_check_segment_list(struct kimage *image) mstart = image->segment[i].mem; mend = mstart + image->segment[i].memsz; + if (mstart > mend) + return -EADDRNOTAVAIL; if ((mstart & ~PAGE_MASK) || (mend & ~PAGE_MASK)) return -EADDRNOTAVAIL; if (mend >= KEXEC_DESTINATION_MEMORY_LIMIT) |