lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 18 Sep 2020 14:45:27 +0200 From: Christoph Hellwig <hch@....de> To: Alexander Viro <viro@...iv.linux.org.uk> Cc: Andrew Morton <akpm@...ux-foundation.org>, Jens Axboe <axboe@...nel.dk>, Arnd Bergmann <arnd@...db.de>, David Howells <dhowells@...hat.com>, linux-arm-kernel@...ts.infradead.org, x86@...nel.org, linux-kernel@...r.kernel.org, linux-mips@...r.kernel.org, linux-parisc@...r.kernel.org, linuxppc-dev@...ts.ozlabs.org, linux-s390@...r.kernel.org, sparclinux@...r.kernel.org, linux-block@...r.kernel.org, linux-scsi@...r.kernel.org, linux-fsdevel@...r.kernel.org, linux-aio@...ck.org, io-uring@...r.kernel.org, linux-arch@...r.kernel.org, linux-mm@...ck.org, netdev@...r.kernel.org, keyrings@...r.kernel.org, linux-security-module@...r.kernel.org Subject: [PATCH 3/9] fs: explicitly check for CHECK_IOVEC_ONLY in rw_copy_check_uvector Explicitly check for the magic value insted of implicitly relying on its number representation. Signed-off-by: Christoph Hellwig <hch@....de> --- fs/read_write.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/fs/read_write.c b/fs/read_write.c index 5db58b8c78d0dd..f153116bc5399b 100644 --- a/fs/read_write.c +++ b/fs/read_write.c @@ -840,8 +840,7 @@ ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector, ret = -EINVAL; goto out; } - if (type >= 0 - && unlikely(!access_ok(buf, len))) { + if (type != CHECK_IOVEC_ONLY && unlikely(!access_ok(buf, len))) { ret = -EFAULT; goto out; } @@ -911,7 +910,7 @@ ssize_t compat_rw_copy_check_uvector(int type, } if (len < 0) /* size_t not fitting in compat_ssize_t .. */ goto out; - if (type >= 0 && + if (type != CHECK_IOVEC_ONLY && !access_ok(compat_ptr(buf), len)) { ret = -EFAULT; goto out; -- 2.28.0
Powered by blists - more mailing lists