git://git.onelab.eu
/
linux-2.6.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
vserver 1.9.5.x5
[linux-2.6.git]
/
arch
/
i386
/
lib
/
usercopy.c
diff --git
a/arch/i386/lib/usercopy.c
b/arch/i386/lib/usercopy.c
index
3347c47
..
51aa2bb
100644
(file)
--- a/
arch/i386/lib/usercopy.c
+++ b/
arch/i386/lib/usercopy.c
@@
-514,6
+514,7
@@
do { \
unsigned long __copy_to_user_ll(void __user *to, const void *from, unsigned long n)
{
unsigned long __copy_to_user_ll(void __user *to, const void *from, unsigned long n)
{
+ BUG_ON((long) n < 0);
#ifndef CONFIG_X86_WP_WORKS_OK
if (unlikely(boot_cpu_data.wp_works_ok == 0) &&
((unsigned long )to) < TASK_SIZE) {
#ifndef CONFIG_X86_WP_WORKS_OK
if (unlikely(boot_cpu_data.wp_works_ok == 0) &&
((unsigned long )to) < TASK_SIZE) {
@@
-573,6
+574,7
@@
survive:
unsigned long
__copy_from_user_ll(void *to, const void __user *from, unsigned long n)
{
unsigned long
__copy_from_user_ll(void *to, const void __user *from, unsigned long n)
{
+ BUG_ON((long)n < 0);
if (movsl_is_ok(to, from, n))
__copy_user_zeroing(to, from, n);
else
if (movsl_is_ok(to, from, n))
__copy_user_zeroing(to, from, n);
else
@@
-597,6
+599,7
@@
unsigned long
copy_to_user(void __user *to, const void *from, unsigned long n)
{
might_sleep();
copy_to_user(void __user *to, const void *from, unsigned long n)
{
might_sleep();
+ BUG_ON((long) n < 0);
if (access_ok(VERIFY_WRITE, to, n))
n = __copy_to_user(to, from, n);
return n;
if (access_ok(VERIFY_WRITE, to, n))
n = __copy_to_user(to, from, n);
return n;
@@
-623,6
+626,7
@@
unsigned long
copy_from_user(void *to, const void __user *from, unsigned long n)
{
might_sleep();
copy_from_user(void *to, const void __user *from, unsigned long n)
{
might_sleep();
+ BUG_ON((long) n < 0);
if (access_ok(VERIFY_READ, from, n))
n = __copy_from_user(to, from, n);
else
if (access_ok(VERIFY_READ, from, n))
n = __copy_from_user(to, from, n);
else