On Mon, Sep 21, 2020 at 12:22:19PM +0200, Rasmus Villemoes wrote: > So, not sure how the above got triggered, but I notice there might be an > edge case in check_zeroed_user(): > > from -= align; > size += align; > > if (!user_read_access_begin(from, size)) > return -EFAULT; > > unsafe_get_user(val, (unsigned long __user *) from, err_fault); > > > Suppose size is (size_t)-3 and align is 3. What's the convention for > access_ok(whatever, 0)? Is that equivalent to access_ok(whatever, 1), or > is it always true (or $ARCH-dependent)?
It's usually true... > But, AFAICT, no current caller of check_zeroed_user can end up passing > in a size that can overflow to 0. E.g. for the case at hand, size cannot > be more than SIZE_MAX-24. Might be worth slapping if (unlikely(!size)) return -EFAULT; // overflow just before user_read_access_begin() to be sure...
