Re: [PATCH v6 1/2] kexec_file: stop the top-down search before it underflows

[Bradley Morgan]

Hi Breno,

> Nothing stops that subtraction at zero, so a search that reaches the
> bottom of the address space wraps temp_start around and continues.

ack, and the wrapped value sails through both existing checks since
it is not below start or buf_min, misses every segment and exclude
range, and the loop breaks with kbuf->mem pointing outside of RAM.

since the walk only moves down... temp_start > end can only be true after
a wrap, so the new check has no false positives. It is also what lets
patch 2 drop the poison < memsz guard.


Please absolutely add:


Reviewed-by: Bradley Morgan <include@xxxxxxxxx>

Thanks!