On Fri, Jun 05, 2015 at 12:07:43AM +0200, Helge Deller wrote:
> In the functions compat_get_bitmap() and compat_put_bitmap() the variable
> nr_compat_longs stores how many compat_ulong_t words should be copied in a
> loop.
>
> The copy loop itself is this:
> if (nr_compat_longs-- > 0) {
> if (__get_user(um, umask)) return -EFAULT;
> } else {
> um = 0;
> }
Er... When does that condition trigger? We start with
(((n)+BITS_PER_COMPAT_LONG-1)/BITS_PER_COMPAT_LONG), which is
essentially DIV_ROUND_UP(n, BITS_PER_BYTE * sizeof(compat_long_t)).
Then we go through DIV_ROUND_UP(n, BITS_PER_BYTE * sizeof(long))
iterations of outer loop, with sizeof(long)/sizeof(compat_long_t)
iterations on inner one every time.
So basically that thing will trigger only on the last pass through
the outer loop. The only way for it to trigger a wraparound would
be to have sizeof(long)/sizeof(compat_long_t) greater than LONG_MAX,
which is, not too likely.
If we decrement nr_compat_longs and want to stop when it reaches zero, why not
use that as the (only) loop condition? As in
for (m = 0, shift = 0; nr_compat_longs--;) {
compat_ulong_t um;
if (__get_user(um, umask++))
return -EFAULT;
m |= (long)um << shift;
shift += BITS_PER_COMPAT_LONG;
if (shift == BITS_PER_LONG) {
shift = 0;
*mask++ = m;
m = 0;
}
}
if (shift)
*mask++ = m;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
