• Helge Deller's avatar
    compat: cleanup coding in compat_get_bitmap() and compat_put_bitmap() · 9b7b819c
    Helge Deller authored
    In the functions compat_get_bitmap() and compat_put_bitmap() the
    variable nr_compat_longs stores how many compat_ulong_t words should be
    copied in a loop.
    
    The copy loop itself is this:
      if (nr_compat_longs-- > 0) {
          if (__get_user(um, umask)) return -EFAULT;
      } else {
          um = 0;
      }
    
    Since nr_compat_longs gets unconditionally decremented in each loop and
    since it's type is unsigned this could theoretically lead to out of
    bounds accesses to userspace if nr_compat_longs wraps around to
    (unsigned)(-1).
    
    Although the callers currently do not trigger out-of-bounds accesses, we
    should better implement the loop in a safe way to completely avoid such
    warp-arounds.
    Signed-off-by: 's avatarHelge Deller <deller@gmx.de>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    9b7b819c