![]() commit 222ca305c9fd39e5ed8104da25c09b2b79a516a8 upstream. Three architectures check the end of a user access against the address limit without taking a possible overflow into account. Passing a negative length or another overflow in here returns success when it should not. Use the most common correct implementation here, which optimizes for a constant 'size' argument, and turns the common case into a single comparison. Cc: stable@vger.kernel.org Fixes: |
||
---|---|---|
.. | ||
configs | ||
include | ||
kernel | ||
lib | ||
mm | ||
Kbuild | ||
Kconfig | ||
Kconfig.debug | ||
Makefile |